A critical vulnerability in the GiveWP WordPress donation plugin could allow attackers to run operating-system commands on affected servers. Tracked as CVE-2026-82222 and rated CVSS 10.0, the flaw affects versions up to 4.16.7.1. GiveWP has more than 100,000 installations, making urgent updates important for charities and other organisations.
Key takeaways
- GiveWP versions through 4.16.7.1 are affected by a PHP object-injection flaw.
- The vulnerability can lead to remote command execution on the WordPress server.
- GiveWP 4.16.7.2 fixes the issue and removes dangerous stored payloads.
- Older or imported donation forms may leave some sites exposed.
- Site owners should update, review logs and check their WordPress maintenance arrangements.
This is not simply a theoretical data leak. Successful exploitation could give an attacker control of the web server account, potentially exposing WordPress files, databases, donor information and other connected resources.
How the GiveWP vulnerability works
Security researchers found a chain of weaknesses involving unsafe PHP deserialization, donation processing and code already bundled with GiveWP. An attacker can place crafted serialized data into a user profile and move it into GiveWP’s session storage through the donation workflow.
A later request causes the stored data to be processed again. Existing classes in GiveWP and the TCPDF library can then act as a “gadget chain”, turning attacker-controlled properties into a call to an operating-system function such as system().
Although parts of the attack appear to require an account, GiveWP’s registration action does not consistently respect WordPress’s setting that disables public registration. Researchers also found conditions under which an attacker can create an account without meaningful administrator involvement. This significantly lowers the barrier to exploitation.
Which websites are most exposed
Versions 4.16.5.1 and earlier can be exploitable on default installations with an active donation gateway and a published form. Versions 4.16.6 through 4.16.7.1 remain vulnerable where a legacy donation form lacks newer formBuilderSettings data.
That means upgraded websites are not automatically safe. Older forms, imported forms and restored backups can preserve the conditions required for the attack, even if the site appears otherwise up to date.
GiveWP releases a fix
GiveWP addressed the vulnerability in version 4.16.7.2. The update blocks serialized data during donation processing, restricts object creation during deserialization, hardens the relevant gadget chain and sanitises donor and billing metadata.
It also removes potentially dangerous serialized objects already stored in affected databases. This database cleanup is important because updating plugin code alone would not remove payloads an attacker may have planted before the upgrade.
What WordPress administrators should do
Update GiveWP to 4.16.7.2 or a later release immediately, then review administrator, registration and web-server logs for unusual activity. Pay particular attention to unexpected accounts, donation submissions, server errors and changes to plugin or theme files.
Check older, imported and restored donation forms as part of the investigation. A WordPress maintenance plan or WordPress care plan can help by combining plugin updates, backups, malware monitoring and regular security checks rather than relying on occasional manual updates.
GiveWP’s registration behaviour remains an access-control concern, even though the patched release prevents it from being used for this command-execution chain. Organisations handling donations should therefore keep registrations restricted where possible and maintain a tested recovery process.
Sources
- GiveWP WordPress donation plugin flaw lets hackers execute server commands, BleepingComputer.
- Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers, Security Affairs.