Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GiveWP WordPress plugin command execution flaw (CVE-2026-82222)

Vulnerability
First reported
Last updated
Happening score
H score 14
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-82222 leaves GiveWP WordPress sites vulnerable to unauthenticated arbitrary command execution, putting more than 100,000 installs at risk of server compromise. The flaw affects GiveWP through version 4.16.7.1 and chains an unsafe unserialize helper, attacker-controlled serialized objects in the donation flow, and a bundled-library gadget chain. Patchstack says the attack can start through an exposed registration action even when WordPress registration is disabled. GiveWP 4.16.7.2 was released on August 27 to block serialized data and restrict object creation during deserialization.

Related Happenings

Everest Forms Pro CVE-2026-3300 active exploitation wave

Exploitation Wave
H score87 First: 05.06.2026 11:38 Last: 05.06.2026 11:38 Sources 1

About this happening: Active exploitation of CVE-2026-3300 in Everest Forms Pro is driving complete site compromise risk for WordPress sites. Attackers have been using the flaw for arbitrar...

Open Happening

Timeline

  1. 28.08.2026 21:18 2 articles · 3h ago

    Udin Chan reports CVE-2026-82222 in GiveWP

    Initial Disclosure

    Udin Chan reported CVE-2026-82222 in the GiveWP plugin for WordPress on July 28, identifying a maximum-severity flaw that lets an unauthenticated attacker execute arbitrary commands on the hosting server. The exploit chain combines an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, a gadget chain in bundled libraries, and an exposed `give_action=user_register` registration path that can create an account even when WordPress registration is disabled.

    Show sources
    Open in new tab
  2. 28.08.2026 21:18 1 articles · 3h ago

    GiveWP 4.16.7.2 blocks serialized data in donation processing

    Mitigation Patch Update

    GiveWP released version 4.16.7.2 on August 27, blocking serialized data during donation processing, restricting object creation at several deserialization points, and removing serialized object payloads already stored in affected databases.

    Show sources
    Open in new tab