The GiveWP plugin for donations and fundraising campaign management has fixed a vulnerability with the highest severity rating that can be exploited to execute arbitrary commands on a WordPress server. The vulnerability is identified as CVE-2026-82222 and affects GiveWP versions up to 4.16.7.1, while version 4.16.7.2 was released to fix it on August 27, 2026.
The plugin is used on more than 100,000 websites, making the flaw significant for administrators of sites that rely on it to receive donations. According to details reported by Patchstack researchers, security researcher Udin Chan reported the vulnerability on July 28 through the Patchstack vulnerability intelligence platform.
A Chain of Three Issues
The exploitation process does not rely on a single flaw, but combines three interconnected weaknesses: an unsafe PHP deserialization mechanism, a donation-processing path that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin that can invoke system commands.
In its basic stage, the attack requires an account on the site, but Patchstack explained that an exposed and undocumented registration procedure allows an account to be created even when registration is disabled in WordPress settings. The attacker uses the account and its profile to store a malicious serialized object, then injects it into the plugin’s session database by submitting a specially crafted donation.
After that, requesting any front-end page using the authentication cookie causes the object to be deserialized and the command specified by the attacker to be executed. Patchstack security researcher George Johnstone said that the server writes the serialized object to the wp_give_sessions table before returning an HTTP 500 response.
When Are the Affected Versions Exploitable?
Versions 4.16.6 through 4.16.7.1 remain vulnerable, but exploitation requires an old donation form that lacks formBuilderSettings. This condition may appear on sites that have been upgraded, that use the options-based form editor, or that have imported or restored old forms.
What Changes in Practice?
Version 4.16.7.2 addresses the flaw by blocking serialized data during donation processing and restricting object creation at several deserialization points. The update also removes previously stored serialized object payloads from the databases of affected sites, an important step because the update is not limited to preventing new exploits.
However, Patchstack noted that the GiveWP registration procedure still does not respect WordPress settings governing whether users may register, although this behavior is no longer exploitable for code execution after the fix. Site administrators should therefore update the plugin to version 4.16.7.2 as soon as possible, while reviewing the presence of old donation forms or signs of account creation and unusual activity.
The flaw is also significant in light of GiveWP being targeted during the previous year, when attackers indirectly used the plugin to compromise Pi-hole, exposing the names and email addresses of 30,000 donors. The source does not establish that the previous exploitation campaign was directly connected to CVE-2026-82222, but it shows that donation plugins may provide an entry point whose impact extends beyond the compromised site itself.