A maximum-severity vulnerability in the GiveWP donation plugin for WordPress — tracked as CVE-2026-82222 — allows an unauthenticated attacker to run arbitrary commands on the hosting server. GiveWP is used by more than 100,000 WordPress sites to collect donations and manage fundraising campaigns. Patchstack researchers who analyzed the flaw describe it as a three-step chain: the plugin exposes an unauthenticated user-registration action (give_action=user_register) that creates an account even when registration is disabled site-wide; after registering, an attacker can store a malicious PHP serialized object in their profile and inject it into the plugin’s session database via a crafted donation; when the server processes any subsequent page request with that cookie, it deserializes the object and executes the embedded system command.
The vulnerability was reported by researcher Udin Chan on July 28 through the Patchstack platform and affects GiveWP versions 4.16.6 through 4.16.7.1. Exploitation requires the site to have a legacy donation form without formBuilderSettings — a condition that exists in upgraded installations and in sites using the option-based form editor or that have imported older forms. GiveWP released the fix in version 4.16.7.2 on August 27, 2026.
How to check if you’re affected
Affected versions of GiveWP are 4.16.6 through 4.16.7.1. Log in to your WordPress dashboard, navigate to Plugins, and check the version listed next to GiveWP. If you are running any version before 4.16.7.2, update immediately via the WordPress plugin updater. Legacy donation forms (those without formBuilderSettings) are the exploitable attack surface — sites that have only used the current block-based form builder are at lower risk, but updating is still the correct action regardless.