# GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands

> GiveWP, a WordPress donation plugin installed on 100,000+ sites, contains an unauthenticated PHP object injection vulnerability (CVE-2026-82222, CVSS 10.0) chainable to remote command execution via an unsafe deserialization helper, donation-session storage of attacker-controlled serialized objects, and a gadget chain terminating in a bundled TestData/TCPDF class. An exposed unauthenticated registration action lets attackers create an account even with WordPress registration disabled, removing the last barrier to exploitation. Fixed in version 4.16.7.2, released 2026-08-27.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2188
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-givewp-plugin-deserialization-rce-tl-2026-2188.webp?v=6da158cd (Threadlinqs threat intel: CVE-2026-82222 GiveWP RCE: Detection & IOCs (TL-2026-2188) — Critical severity, 11 IOCs, 9 detection rules.)
- **ID:** TL-2026-2188
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 11
- **CVEs:** CVE-2026-82222

## Description

CVE-2026-82222 is a CVSS 10.0 / CWE-502 unauthenticated PHP object injection vulnerability in GiveWP, a WordPress donation and fundraising plugin maintained by StellarWP/Liquid Web with more than 100,000 active installations. Security researcher Udin Chan reported the flaw to Patchstack on 2026-07-28; Patchstack researcher George Johnstone published the technical analysis, and the vendor shipped a fix in version 4.16.7.2 on 2026-08-27.

The vulnerability chains three distinct issues. First, GiveWP exposes an unauthenticated `give_action=user_register` action that never consults WordPress's `users_can_register` setting, letting an attacker create an account and receive an authentication cookie even on sites with registration disabled. A 4.16.6 attempt to gate this with a nonce was ineffective because the nonce rendered by the public `[give_register]` shortcode is identical for every logged-out visitor to the same page and can simply be harvested and reused. Second, the attacker harvests a second, separately-reusable nonce rendered on the donor `profile.php` editor page (the same identical-nonce-for-every-anonymous/authenticated-visitor weakness as the registration bypass) and uses it to POST a malicious PHP serialized object into the newly created account's `last_name` user-meta field. Submitting a donation (`give_action=give_process_donation`) that omits `give_last` causes `give_process_donation_form()` to pull the poisoned `last_name` value and `give_set_purchase_session()` to persist it, unserialized, into the `wp_give_sessions` database table before the request returns an HTTP 500; because this value is read back from the account rather than taken directly from the request, ordinary input validation on the donation POST never inspects it. Third, GiveWP's `Give\Helpers\Utils::maybeSafeUnserialize()`/`safeUnserialize()` helper calls PHP's `unserialize()` with `allowed_classes => false`, which prevents the object from being instantiated on the spot but returns a `__PHP_Incomplete_Class` placeholder — critically, when that placeholder is serialized again PHP writes the exact original class name and property bytes back out unchanged, so the gadget survives intact and comes to life when the session data is later read and re-serialized/re-unserialized on a subsequent authenticated page request. The terminal gadget lives in GiveWP's bundled TestData framework: `Give\TestData\Framework\ProviderForwarder::__call()` executes `call_user_func_array($this->loadedProviders[$name], $arguments)`, and an attacker who controls `loadedProviders` can point it at `system()` with an arbitrary OS command, reached via a TCPDF `__destruct()`/`_destroy()` entry point bundled with the plugin.

Exploitability is version-dependent. On 4.16.5.1 and earlier the chain is reachable by default (the plugin ships active `manual`/`offline` gateways and needs only one published donation form). Versions 4.16.6 through 4.16.7.1 narrowed reachability because the legacy donation processor rejects Visual Form Builder v3 forms, but any `give_forms` post lacking `formBuilderSettings` — regardless of status (draft, trash, published), covering upgraded sites, imports, and sites with the "Option-Based Form Editor" enabled — re-opens the chain. Version 4.16.7.2 closes the flaw by blocking serialized data during donation processing, restricting object creation at deserialization points, and stripping any already-stored malicious payloads from the database.

Patchstack characterizes this as high-priority and expects mass-campaign exploitation against WordPress sites running vulnerable GiveWP versions, consistent with the plugin's history of prior object-injection/deserialization issues (e.g., CVE-2025-22777, CVE-2024-5932). As of this writing there is no public literal exploit script and no confirmed in-the-wild exploitation or CISA KEV listing, but the publicly documented function/class-level exploitation chain is detailed enough to be functionally equivalent to a public PoC for a capable attacker.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1136.001 Local Account
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1565.001 Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Server Worker Process Spawning Command Interpreter (GiveWP ProviderForwarder RCE)** (`TL-2026-2188-SPL-003`)

Detects a PHP-FPM, Apache, or Nginx worker process spawning a shell or common attacker living-off-the-land binary, consistent with the ProviderForwarder::__call() -> call_user_func_array() -> system() gadget chain reaching arbitrary OS command execution in CVE-2026-82222.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.004, T1190
- **Data sources:** sysmon_for_linux, edr_process_telemetry, auditd
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="Sysmon:Linux" EventCode=1
(ParentImage="*php-fpm*" OR ParentImage="*apache2*" OR ParentImage="*httpd*" OR ParentImage="*nginx*")
Image IN ("/bin/sh","/bin/bash","/usr/bin/curl","/usr/bin/wget","/usr/bin/id","/usr/bin/whoami","/usr/bin/python3","/usr/bin/perl")
| table _time host ParentImage Image CommandLine User
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("php-fpm","php-fpm7.4","php-fpm8.1","apache2","httpd","nginx")
| where FileName in~ ("sh","bash","curl","wget","id","whoami","python3","perl")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
```

### Sigma

```yaml
title: Web Server Worker Process Spawning Command Interpreter (GiveWP ProviderForwarder RCE)
id: 4e6f8a0c-2d4e-4f6a-8c0e-3f5a7c9e1b3d
status: experimental
description: Detects a PHP-FPM, Apache, or Nginx worker process spawning a shell or common attacker living-off-the-land binary, consistent with the ProviderForwarder::__call() -> call_user_func_array() -> system() gadget chain reaching arbitrary OS command execution in CVE-2026-82222.
references:
    - https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.004
    - attack.initial-access
    - attack.t1190
    - cve.2026.82222
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - 'php-fpm'
            - 'apache2'
            - 'httpd'
            - 'nginx'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/curl'
            - '/wget'
            - '/id'
            - '/whoami'
            - '/python3'
            - '/perl'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate WordPress plugins/cron jobs that intentionally shell out (image/PDF conversion tools, backup plugins) — baseline per host before alerting
    - Package-manager or health-check scripts invoked by a supervisor process misidentified as the web server
level: critical
```

**Known false positives:**

- Legitimate WordPress plugins/cron jobs that intentionally shell out (image/PDF conversion tools, backup plugins) — baseline per host before alerting
- Package-manager or health-check scripts invoked by a supervisor process misidentified as the web server

**Tuning notes:** Baseline legitimate PHP shell-out behavior per host (e.g. ImageMagick, wkhtmltopdf, backup plugins) and add them to an allowlist rather than excluding the parent-process match entirely.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GiveWP Plugin Version Fingerprinting Followed by Unauthenticated Registration Call (locked: unlock with TL Creds)
- GiveWP Donation Processing HTTP 500 Following give_last Omission (wp_give_sessions Poisoning) (locked: unlock with TL Creds)
- Outbound Network Connection from Web Server Worker Following GiveWP Exploitation (locked: unlock with TL Creds)
- Unauthenticated GiveWP Donation Submission Missing give_last (Session Poisoning Trigger) (locked: unlock with TL Creds)
- GiveWP TestData ProviderForwarder Gadget Reactivation in PHP Error Log (locked: unlock with TL Creds)
- PHP File Written to WordPress wp-content by Web Server Process (Post-GiveWP-RCE Webshell Drop) (locked: unlock with TL Creds)
- GiveWP Nonce Reuse Across Multiple Source IPs (Registration/Donation Bypass Chain) (locked: unlock with TL Creds)
- PHP Serialized Object Marker in GiveWP profile.php or Donation POST Body (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GiveWP WordPress donation plugin flaw lets hackers execute server commands](https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/)
- [Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP](https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp)
- [WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability](https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability)
- [NVD - CVE-2026-82222](https://nvd.nist.gov/vuln/detail/CVE-2026-82222)
- [GiveWP – Donation Plugin and Fundraising Platform (WordPress.org plugin listing)](https://wordpress.org/plugins/give/)
- [GiveWP changelog (develop) — 4.16.7 / 4.16.7.1 / 4.16.7.2 entries](https://github.com/impress-org/givewp/blob/develop/changelog.txt)
- [CISA Known Exploited Vulnerabilities Catalog (checked 2026-08-28 — CVE-2026-82222 not listed)](https://www.cisa.gov/known-exploited-vulnerabilities)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2188