A critical vulnerability in the GiveWP plugin for WordPress, tracked as CVE-2026-82222, allows unauthenticated attackers to execute commands on affected servers. The flaw, present in versions up to 4.16.7.1, was reported by researcher Udin Chan and fixed in version 4.16.7.2. The vulnerability results from unsafe management of serialized PHP objects, enabling attackers to insert malicious payloads into donation forms, which leads to full remote code execution.
GiveWP's donation process facilitates this exploitation by accepting attacker-controlled data, which can reach the session storage and be improperly handled during deserialization. Patchstack notes that the plugin's features also allow account creation circumventing WordPress's registration settings. Version 4.16.7.2 addresses the issue by implementing stricter data handling and cleanup of potentially dangerous serialized objects. Administrators are urged to upgrade to the latest version and audit existing data.