GiveWP WordPress Donation Plugin: Unauthenticated CVSS 10.0 RCE — 100k Sites Face Full Server Takeover

Patchstack discloses GiveWP WordPress donation plugin CVE-2026-82222, CVSS 3.1 10.0. Unauthenticated attackers chain registration bypass + deserialization + bundled-library gadget chain to run arbitrary system commands on the host. 100k+ WordPress sites affected. All versions 4.16.6 through 4.16.7.1 must upgrade to 4.16.7.2.

Incident Overview

On 27 August 2026, Patchstack disclosed CVE-2026-82222 after the fix shipped with GiveWP 4.16.7.2. The GiveWP WordPress donation plugin has an unauthenticated RCE, CVSS 3.1 10.0, CWE-502 Deserialization of Untrusted Data. GiveWP is the most popular donation and fundraising plugin in the WordPress ecosystem, 100k+ installs worldwide. Nonprofits, charities, and public-interest projects rely on it for donation flows. Independent researcher Udin Chan reported it on 28 July via the Patchstack vuln-intel platform. Vendor shipped 4.16.7.2 on 27 August. No WordPress credentials required. Attacker ends up running arbitrary system commands as the plugin service account: plant a persistent WebShell, exfil donor PII, pivot internally.

Technical Details

CVE-2026-82222 is a three-bug chain:

• Registration-action bypass: GiveWP exposes unauthenticated action `give_action=user_register` and ignores the WordPress global `users_can_register` setting. Even with registration off under `Settings → General → Membership`, the attacker can still create an account and obtain a WordPress login cookie;
• PHP object injection: donation handling writes attacker-controlled data into the `wp_give_sessions` session table. Attacker plants a crafted deserialized object in the user profile and triggers it with one donation. `unserialize()` runs on a front-end request;
• Gadget chain: bundled TCPDF plus GiveWP's own `\Give\TestData` test class supply `__destruct`, `__wakeup`, `__toString` magic-method chains that invoke arbitrary system commands.

Full exploit chain needs:

• WordPress site with GiveWP active and at least one published donation form;
• At least one payment gateway enabled;
• At least one legacy form without `formBuilderSettings` — common on historical upgrades, options-based form editors, or imported old forms;
• Affected version range: 4.16.6 through 4.16.7.1. 4.16.5.1 and earlier reach full command execution by default.

Patchstack: server deserializes while handling any front-end page request. HTTP 500 + a malicious row in `wp_give_sessions` is the most direct signal. CVSS vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`: network-reachable, no privileges, no user interaction, impact crosses the component boundary.

Impact

• GiveWP ≤ 4.16.7.1 (CVSS 3.1 10.0 / CVSS 4.0 9.3). Default chain reachable from 4.16.6;
• 100k+ GiveWP installs on WordPress. Heavy use in education, medical aid, community fundraising, religious orgs, overseas NGOs;
• Donation flows natively wire Stripe/PayPal and similar gateways. Compromised sites hit donor data and payment credentials together;
• Maps to PCI DSS 4.0 / 6.2.4, NYDFS 23 NYCRR 500 / 500.08, DORA / Article 9, NIS2 / Article 21, CISA ZTMM 2.0 ZT.AM-3.

Remediation

• Upgrade GiveWP to 4.16.7.2 or later in WordPress admin under Plugins → Installed Plugins. If the version menu does not auto-update, download the latest from wordpress.org and overwrite. WP-CLI:

wp plugin update give
wp plugin get give --field=version

Version must be ≥ 4.16.7.2;

• After upgrade, rotate WordPress admin passwords, database passwords, SMTP credentials, and payment-gateway secrets immediately;
• Check `wp_users` for stranger accounts not created by an admin, `wp_give_sessions` for oversized serialized strings, and web/PHP error logs for uncaught exceptions and HTTP 500s;
• At WAF/CDN, block unexpected POSTs to `?give_action=user_register`. Block requests whose cookies carry the `O:` serialization marker;
• Inventory all donation pages still on legacy forms (non-Block Editor). Migrate with GiveWP's built-in Form Migration tool to the new Form Builder;
• Publish a donor notice. Tell them to watch card and mailbox anomalies.

References

• Patchstack: GiveWP Unauthenticated PHP Object Injection to RCE
• BleepingComputer: GiveWP WordPress donation plugin flaw lets hackers execute server commands
• NVD: CVE-2026-82222
• GiveWP Official Changelog