# GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands

> GiveWP, a WordPress donation plugin installed on 100,000+ sites, contains an unauthenticated PHP object injection vulnerability (CVE-2026-82222, CVSS 10.0) chainable to remote command execution via an unsafe deserialization helper, donation-session storage of attacker-controlled serialized objects, and a gadget chain terminating in a bundled TestData/TCPDF class. An exposed unauthenticated registration action lets attackers create an account even with WordPress registration disabled, removing the last barrier to exploitation. Fixed in version 4.16.7.2, released 2026-08-27.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2188
- **ID:** TL-2026-2188
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-82222

## Description

CVE-2026-82222 is a CVSS 10.0 / CWE-502 unauthenticated PHP object injection vulnerability in GiveWP, a WordPress donation and fundraising plugin maintained by StellarWP/Liquid Web with more than 100,000 active installations. Security researcher Udin Chan reported the flaw to Patchstack on 2026-07-28; Patchstack researcher George Johnstone published the technical analysis, and the vendor shipped a fix in version 4.16.7.2 on 2026-08-27.

The vulnerability chains three distinct issues. First, GiveWP exposes an unauthenticated `give_action=user_register` action that never consults WordPress's `users_can_register` setting, letting an attacker create an account and receive an authentication cookie even on sites with registration disabled. A 4.16.6 attempt to gate this with a nonce was ineffective because the nonce rendered by the public `[give_register]` shortcode is identical for every logged-out visitor to the same page and can simply be harvested and reused. Second, the attacker harvests a second, separately-reusable nonce rendered on the donor `profile.php` editor page (the same identical-nonce-for-every-anonymous/authenticated-visitor weakness as the registration bypass) and uses it to POST a malicious PHP serialized object into the newly created account's `last_name` user-meta field. Submitting a donation (`give_action=give_process_donation`) that omits `give_last` causes `give_process_donation_form()` to pull the poisoned `last_name` value and `give_set_purchase_session()` to persist it, unserialized, into the `wp_give_sessions` database table before the request returns an HTTP 500; because this value is read back from the account rather than taken directly from the request, ordinary input validation on the donation POST never inspects it. Third, GiveWP's `Give\Helpers\Utils::maybeSafeUnserialize()`/`safeUnserialize()` helper calls PHP's `unserialize()` with `allowed_classes => false`, which prevents the object from being instantiated on the spot but returns a `__PHP_Incomplete_Class` placeholder — critically, when that placeholder is serialized again PHP writes the exact original class name and property bytes back out unchanged, so the gadget survives intact and comes to life when the session data is later read and re-serialized/re-unserialized on a subsequent authenticated page request. The terminal gadget lives in GiveWP's bundled TestData framework: `Give\TestData\Framework\ProviderForwarder::__call()` executes `call_user_func_array($this->loadedProviders[$name], $arguments)`, and an attacker who controls `loadedProviders` can point it at `system()` with an arbitrary OS command, reached via a TCPDF `__destruct()`/`_destroy()` entry point bundled with the plugin.

Exploitability is version-dependent. On 4.16.5.1 and earlier the chain is reachable by default (the plugin ships active `manual`/`offline` gateways and needs only one published donation form). Versions 4.16.6 through 4.16.7.1 narrowed reachability because the legacy donation processor rejects Visual Form Builder v3 forms, but any `give_forms` post lacking `formBuilderSettings` — regardless of status (draft, trash, published), covering upgraded sites, imports, and sites with the "Option-Based Form Editor" enabled — re-opens the chain. Version 4.16.7.2 closes the flaw by blocking serialized data during donation processing, restricting object creation at deserialization points, and stripping any already-stored malicious payloads from the database.

Patchstack characterizes this as high-priority and expects mass-campaign exploitation against WordPress sites running vulnerable GiveWP versions, consistent with the plugin's history of prior object-injection/deserialization issues (e.g., CVE-2025-22777, CVE-2024-5932). As of this writing there is no public literal exploit script and no confirmed in-the-wild exploitation or CISA KEV listing, but the publicly documented function/class-level exploitation chain is detailed enough to be functionally equivalent to a public PoC for a capable attacker.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1136.001 Local Account
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1565.001 Stored Data Manipulation

## Sources

- [GiveWP WordPress donation plugin flaw lets hackers execute server commands](https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/)
- [Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP](https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp)
- [WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability](https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability)
- [NVD - CVE-2026-82222](https://nvd.nist.gov/vuln/detail/CVE-2026-82222)
- [GiveWP – Donation Plugin and Fundraising Platform (WordPress.org plugin listing)](https://wordpress.org/plugins/give/)
- [GiveWP changelog (develop) — 4.16.7 / 4.16.7.1 / 4.16.7.2 entries](https://github.com/impress-org/givewp/blob/develop/changelog.txt)
- [CISA Known Exploited Vulnerabilities Catalog (checked 2026-08-28 — CVE-2026-82222 not listed)](https://www.cisa.gov/known-exploited-vulnerabilities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2188