A critical security vulnerability has been discovered in the GiveWP plugin for WordPress, a widely used tool for collecting donations and managing fundraising campaigns. The flaw, designated CVE-2026-82222, allows an unauthenticated attacker to execute arbitrary commands on the hosting server, potentially compromising the entire site.

According to Patchstack researchers, exploitation involves chaining three distinct issues: an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands.

Crucially, while successful exploitation typically requires an attacker to have an account on the target site, Patchstack notes that GiveWP exposes an unauthenticated registration action—give_action=user_register—that never consults WordPress's users_can_register option. "Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence," Patchstack explains.

Once authenticated, hackers can store a malicious serialized object in their profile and inject it into the plugin's session database by submitting a crafted donation. "The server writes the gadget object into wp_give_sessions before returning an HTTP 500," said George Johnstone, cybersecurity researcher at Patchstack. By requesting any front-end page with the authentication cookie, the server unserializes the gadget and executes the command from the attacker.

Versions 4.16.6 through 4.16.7.1 remain vulnerable, though exploitation requires the site to contain a legacy donation form without 'formBuilderSettings.' Patchstack notes such conditions may exist in upgraded installations, sites using the plugin's option-based form editor, or when importing or restoring older forms.

GiveWP fixed the vulnerability in version 4.16.7.2 by blocking serialized data during donation processing and restricting object creation at several deserialization points. The update also removes serialized object payloads already stored in affected databases.

However, Patchstack observes that GiveWP's registration action still does not honor WordPress user registration settings, though this issue is no longer exploitable for code execution.

Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222.