A Critical Flaw in GiveWP Plugin Exposes Hosting Servers to Hacker Attacks
A serious vulnerability has been discovered in the popular GiveWP donation plugin for WordPress, allowing hackers to execute arbitrary commands on hosting servers with ease. This maximum-severity flaw, identified as CVE-2026-82222, affects all versions of the plugin up to 4.16.7.1 and can be exploited even if registration is disabled on the target site.
GiveWP has over 100,000 installs worldwide and is used by websites to collect donations and manage fundraising campaigns. The security issue arises from a combination of three distinct vulnerabilities in the plugin’s code. Firstly, an insecure helper function allows unserialized PHP data to be processed, which is then stored as attacker-controlled objects during donation processing. These objects can be injected into the plugin’s session database, where they are executed by the server.
The exploitation process is made possible by a peculiar aspect of the GiveWP registration action. Even when registration is disabled on a site, an unauthenticated user can still create an account and receive an authentication cookie, allowing them to bypass other security measures. Once authenticated, hackers can store malicious serialized objects in their profile and inject them into the plugin’s session database by submitting crafted donations.
The final step in the exploitation process involves requesting any front-end page with the authentication cookie. The server then unserializes the gadget object and executes the command from the attacker, granting them full access to the hosting server. This vulnerability affects all versions of GiveWP between 4.16.6 and 4.16.7.1.
Fortunately, GiveWP has since released an update (version 4.16.7.2) that addresses this issue by blocking serialized data during donation processing and restricting object creation at several deserialization points. The update also removes any existing serialized object payloads from affected databases. However, website administrators are still urged to apply the security updates as soon as possible to prevent malicious exploitation.
This vulnerability highlights the importance of regular plugin updates and secure coding practices in preventing hacker attacks. As we’ve seen before, even seemingly secure plugins can harbor hidden flaws that can be exploited by determined attackers. To avoid falling victim to this or similar vulnerabilities, website administrators should ensure they’re running the latest versions of all installed plugins, including GiveWP.
In addition, using a reputable security scanner and monitoring plugin usage can help identify potential issues before they become major problems. By staying informed about the latest security threats and taking proactive measures, website administrators can protect their sites from malicious attacks and safeguard their users’ sensitive information.
Source: Bleeping Computer — 2026-08-28