A severe vulnerability has been discovered in the GiveWP plugin for WordPress, allowing hackers to execute arbitrary commands on a hosting server. This flaw, identified as CVE-2026-82222, affects versions 4.16.6 through 4.16.7.1 of the plugin and has already been exploited by attackers to gain unauthorized access.
GiveWP is a popular donation plugin with over 100,000 installations, used for collecting donations and managing fundraising campaigns on WordPress sites. The security issue lies in the way GiveWP processes donations, allowing an attacker to store a malicious serialized object in the plugin’s session database. This object can then be executed as system commands by the server, granting the hacker full control over the hosting environment.
To exploit this vulnerability, an attacker typically needs to have an account on the target site. However, Patchstack researchers have found that GiveWP exposes an unauthenticated registration action that allows attackers to create accounts even when registration is disabled. This creates a pathway for hackers to gain access and execute malicious code. The exploitation process involves chaining three distinct issues: unsafe deserialization of PHP data, storage of attacker-controlled serialized objects in the donation flow, and a gadget chain in libraries bundled with the plugin.
The vulnerability was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform. GiveWP fixed the issue in version 4.16.7.2, released on August 27, which blocks serialized data during donation processing and restricts object creation at several deserialization points. The update also removes existing malicious payloads from affected databases.
Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222. It is essential for users to keep their plugins up-to-date, especially those with high installation numbers like GiveWP, to minimize the risk of similar attacks in the future.
This vulnerability highlights the importance of keeping software and plugins updated, even if they seem secure or have been recently updated. Attackers often look for vulnerabilities that have not yet been patched, so timely updates can prevent significant security breaches. Additionally, administrators should regularly review their plugin settings to ensure they are not inadvertently exposing themselves to attacks.
In related news, GiveWP was targeted by hackers last year who used it as a stepping stone to indirectly breach Pi-hole, a popular network-level ad-blocker, compromising the names and email addresses of 30,000 donors. This incident underscores the need for website administrators to prioritize security measures and stay informed about emerging threats.
Given the severity of this vulnerability, GiveWP users should take immediate action to protect their sites from potential attacks. By applying the latest security updates and reviewing plugin settings, administrators can significantly reduce the risk of unauthorized access and data breaches.
Source: Bleeping Computer — 2026-08-28