A vulnerability in GiveWP, a widely used WordPress plugin for collecting donations and running fundraising campaigns, allowed attackers to execute commands on the servers hosting affected websites without needing a username or password. The flaw, tracked as CVE-2026-82222, was patched on August 27, 2026, according to reporting from BleepingComputer based on an advisory published by the vulnerability intelligence platform Patchstack.
GiveWP is installed on more than 100,000 WordPress sites, many of them run by nonprofits, charities and other organizations that use it to process donations. Researcher Udin Chan reported the flaw on July 28. Patchstack researcher George Johnstone, who analyzed the disclosure, explained how the vulnerability could be exploited even on sites where public account registration had been turned off entirely.
The attack chains together three separate weaknesses in the plugin: unsafe handling of serialized PHP data, a donation-processing feature that stores attacker-controlled data objects, and a set of so-called gadget chains in libraries bundled with the plugin that can be strung together to run malicious code once that stored data is deserialized. Johnstone’s analysis noted that even with registration disabled, an attacker can still create an account and obtain an authentication cookie through the donation process itself, then use that access to trigger the rest of the exploit chain and run arbitrary commands on the server.
The vulnerability affects all GiveWP versions through 4.16.7.1. The plugin’s developers fixed it in version 4.16.7.2, released August 27. Per Patchstack’s advisory, the update blocks serialized data from being processed during donation handling, restricts what kinds of objects can be created at the points where deserialization occurs, and removes any malicious payloads that may already have been stored in a site’s database by earlier exploitation attempts.
This is not the first time a flaw in GiveWP has led to real-world consequences. Earlier vulnerabilities in the plugin were linked to a 2023 breach affecting the Pi-hole project, which exposed information belonging to roughly 30,000 donors, according to BleepingComputer’s reporting. No CVSS score or confirmed reports of active exploitation of this specific flaw, CVE-2026-82222, were available at the time of publication, and BleepingComputer’s reporting describes it only as a maximum-severity issue given its lack of authentication requirements and its potential for full server compromise.
WordPress site administrators running GiveWP are advised to update to version 4.16.7.2 or later as soon as possible. Organizations that process donations through the plugin should also check server and database logs for signs of prior compromise, since the patch removes known malicious payloads but cannot undo access an attacker may have already gained before updating.
Source: BleepingComputer, “GiveWP WordPress donation plugin flaw lets hackers execute server commands”.
