GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands

GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets (TL-2026-2188) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-28. It has no confirmed attribution, affects StellarWP / Liquid Web GiveWP – Donation Plugin and Fundraising, references 1 CVE (CVE-2026-82222), maps to 9 MITRE ATT&CK techniques (T1059, T1059.004, T1078), and is covered by 9 detection rules and 11 indicators of compromise.

Key facts for TL-2026-2188

Threat ID
TL-2026-2188
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-28
Last reviewed
2026-08-28
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
nonprofit, charity, religious-organizations, education, ngo
Target regions
Global
Detection rules
9
Indicators of compromise
11

Malware and tooling in GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

Malware and tooling: TCPDF

GiveWP, a WordPress donation plugin installed on 100,000+ sites, contains an unauthenticated PHP object injection vulnerability (CVE-2026-82222, CVSS 10.0) chainable to remote command execution via an unsafe deserialization helper, donation-session storage of attacker-controlled serialized objects, and a gadget chain terminating in a bundled TestData/TCPDF class. An exposed unauthenticated registration action lets attackers create an account even with WordPress registration disabled, removing the last barrier to exploitation. Fixed in version 4.16.7.2, released 2026-08-27.

How GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets works

CVE-2026-82222 is a CVSS 10.0 / CWE-502 unauthenticated PHP object injection vulnerability in GiveWP, a WordPress donation and fundraising plugin maintained by StellarWP/Liquid Web with more than 100,000 active installations. Security researcher Udin Chan reported the flaw to Patchstack on 2026-07-28; Patchstack researcher George Johnstone published the technical analysis, and the vendor shipped a fix in version 4.16.7.2 on 2026-08-27.

The vulnerability chains three distinct issues. First, GiveWP exposes an unauthenticated `give_action=user_register` action that never consults WordPress's `users_can_register` setting, letting an attacker create an account and receive an authentication cookie even on sites with registration disabled. A 4.16.6 attempt to gate this with a nonce was ineffective because the nonce rendered by the public `[give_register]` shortcode is identical for every logged-out visitor to the same page and can simply be harvested and reused. Second, the attacker harvests a second, separately-reusable nonce rendered on the donor `profile.php` editor page (the same identical-nonce-for-every-anonymous/authenticated-visitor weakness as the registration bypass) and uses it to POST a malicious PHP serialized object into the newly created account's `last_name` user-meta field. Submitting a donation (`give_action=give_process_donation`) that omits `give_last` causes `give_process_donation_form()` to pull the poisoned `last_name` value and `give_set_purchase_session()` to persist it, unserialized, into the `wp_give_sessions` database table before the request returns an HTTP 500; because this value is read back from the account rather than taken directly from the request, ordinary input validation on the donation POST never inspects it. Third, GiveWP's `Give\Helpers\Utils::maybeSafeUnserialize()`/`safeUnserialize()` helper calls PHP's `unserialize()` with `allowed_classes => false`, which prevents the object from being instantiated on the spot but returns a `__PHP_Incomplete_Class` placeholder — critically, when that placeholder is serialized again PHP writes the exact original class name and property bytes back out unchanged, so the gadget survives intact and comes to life when the session data is later read and re-serialized/re-unserialized on a subsequent authenticated page request. The terminal gadget lives in GiveWP's bundled TestData framework: `Give\TestData\Framework\ProviderForwarder::__call()` executes `call_user_func_array($this->loadedProviders[$name], $arguments)`, and an attacker who controls `loadedProviders` can point it at `system()` with an arbitrary OS command, reached via a TCPDF `__destruct()`/`_destroy()` entry point bundled with the plugin.

Exploitability is version-dependent. On 4.16.5.1 and earlier the chain is reachable by default (the plugin ships active `manual`/`offline` gateways and needs only one published donation form). Versions 4.16.6 through 4.16.7.1 narrowed reachability because the legacy donation processor rejects Visual Form Builder v3 forms, but any `give_forms` post lacking `formBuilderSettings` — regardless of status (draft, trash, published), covering upgraded sites, imports, and sites with the "Option-Based Form Editor" enabled — re-opens the chain. Version 4.16.7.2 closes the flaw by blocking serialized data during donation processing, restricting object creation at deserialization points, and stripping any already-stored malicious payloads from the database.

Patchstack characterizes this as high-priority and expects mass-campaign exploitation against WordPress sites running vulnerable GiveWP versions, consistent with the plugin's history of prior object-injection/deserialization issues (e.g., CVE-2025-22777, CVE-2024-5932). As of this writing there is no public literal exploit script and no confirmed in-the-wild exploitation or CISA KEV listing, but the publicly documented function/class-level exploitation chain is detailed enough to be functionally equivalent to a public PoC for a capable attacker.

MITRE ATT&CK techniques used in TL-2026-2188

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Persistence

T1078 Valid Accounts; T1136.001 Local Account

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1592.002 Software; T1594 Search Victim-Owned Websites

Affected products and versions in GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

  • StellarWP / Liquid Web — GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, slug `give`)
    Vulnerable versions: through 4.16.7.1 (full default-install chain on 4.16.5.1 and earlier; requires a form lacking formBuilderSettings on 4.16.6–4.16.7.1)
    Fixed in: 4.16.7.2

Remediation for GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

Patches

  • GiveWP 4.16.7.2 (released 2026-08-27) — blocks serialized data during donation processing, restricts object instantiation at deserialization points, and strips existing stored malicious payloads from the database.

Immediate actions

  • Update GiveWP to version 4.16.7.2 or later immediately on every WordPress site where it is installed.
  • Audit the `wp_give_sessions` table and the `last_name` user-meta field for all site accounts for anomalous PHP serialized-object data (values beginning with `O:`), and purge any found.
  • Review recently created WordPress user accounts for unexpected registrations via the `give_action=user_register` endpoint, especially on sites where 'Anyone can register' is disabled.

Workarounds

  • Where immediate patching is not possible, disable GiveWP donation forms and the `[give_register]` shortcode, and block requests containing `give_action=user_register` or `give_action=give_process_donation` targeting legacy (non-`formBuilderSettings`) form IDs at the WAF layer.

Longer-term hardening

  • Deploy a WAF/reverse-proxy rule blocking PHP serialization markers (`O:<len>:"<class>"`) in donation-form and profile-update POST bodies.
  • Disable or restrict the public `[give_register]` shortcode where self-service donor account creation is not required.
  • Monitor PHP-FPM/Apache worker processes on WordPress hosts for unexpected `system()`/shell-exec child processes.

CVEs associated with GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

CVE-2026-82222

Weaknesses (CWE) in GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

CWE-502, CWE-306

Timeline of GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

  • Security researcher Udin Chan reports the PHP object injection / registration bypass chain in GiveWP to Patchstack; vendor is contacted.
  • GiveWP 4.16.7 is released with unrelated security hardening (donor-account email access authentication, checkout login form validation) while CVE-2026-82222 remains unpatched.
  • GiveWP 4.16.7.1 is released (PayPal Donations order-request validation); the CVE-2026-82222 object-injection chain remains exploitable via forms lacking formBuilderSettings.
  • GiveWP 4.16.7.2 is released, blocking serialized data in donation processing, restricting deserialization object creation, and stripping stored malicious payloads — fixing CVE-2026-82222.
  • BleepingComputer reports on the flaw, noting the plugin's 100,000+ active installations and the unauthenticated registration bypass.
  • Patchstack publishes technical analysis of the unauthenticated PHP object injection to RCE chain, crediting Udin Chan and researcher George Johnstone.
  • CVE-2026-82222 is published with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Sources cited for GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets

More in vulnerability

Detection coverage for TL-2026-2188

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2188 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats