GiveWP WordPress Vulnerability Allows Remote Server Command Execution

A critical GiveWP WordPress vulnerability could let attackers execute commands on a vulnerable website’s hosting server. Site owners should update the donation plugin immediately.

GiveWP flaw affects more than 100,000 sites

The issue, tracked as CVE-2026-82222, affects GiveWP versions up to 4.16.7.1.

GiveWP is a popular WordPress donation plugin with more than 100,000 active installations. It helps organisations collect donations and manage fundraising campaigns.

Security researcher Udin Chan reported the flaw through Patchstack on July 28.

Multiple issues enable server command execution

Patchstack said the GiveWP WordPress vulnerability relies on a chain of three security issues.

The chain involves unsafe PHP data deserialisation, a donation flow that can store attacker-controlled data and vulnerable libraries included with the plugin. Together, these issues can allow arbitrary commands to run on the affected server.

The attack requires an account on the target website. However, researchers found that an exposed GiveWP registration action could allow attackers to create an account even when WordPress registration is disabled.

Legacy donation forms face the highest risk

After gaining an account, an attacker could use a specially crafted donation request to store malicious data in the plugin’s session database.

The server could then process that data when a visitor loads a front-end page. This could trigger command execution on the hosting server.

Versions 4.16.6 through 4.16.7.1 are vulnerable when a site has a legacy donation form without formBuilderSettings.

This condition may affect upgraded websites, sites using the option-based form editor or installations that imported older donation forms.

GiveWP releases security update

GiveWP fixed CVE-2026-82222 in version 4.16.7.2, released on August 27.

The update blocks serialised data during donation processing and restricts object creation at several deserialisation points. It also removes stored serialised object payloads from affected databases.

Patchstack noted that GiveWP’s registration action still does not follow WordPress user-registration settings. However, researchers said attackers can no longer use the issue to achieve remote code execution.

Administrators should update GiveWP as soon as possible. They should also review their website for unusual administrator accounts, unexpected donation activity and other signs of unauthorised access.