Critical Vulnerability Discovered in GiveWP Plugin for WordPress
A grave vulnerability has been uncovered in the GiveWP plugin for WordPress, presenting an opportunity for an unauthenticated attacker to execute arbitrary commands on the associated hosting server.
Designated as CVE-2026-82222, this security flaw impacts GiveWP versions up to 4.16.7.1. The issue was brought to light by cybersecurity researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.
With over 100,000 installations, the GiveWP plugin facilitates the collection of donations and the management of fundraising endeavors.
According to Patchstack researchers, the exploitation of this vulnerability hinges upon the amalgamation of three distinct issues:
- An inadequate helper function for unserializing PHP data
- A donation-processing workflow harboring attacker-controlled serialized objects
- A gadget chain within the library integrations that enables the invocation of arbitrary system commands
While successful exploitation necessitates that the attacker possesses an account on the target site, an exposed unauthenticated registration feature inadvertently grants access even when registration is ostensibly disabled.
Patchstack elucidated, “[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that does not consult the WordPress users_can_register parameter.”
This loophole means that even on sites with registration effectively disabled, attackers can create accounts, acquire authentication cookies, and proceed with their malicious activities.
Post-authentication, hackers can embed a nefarious serialized object within their user profile, subsequently injecting it into the plugin’s session database via a uniquely crafted donation submission.
Patchstack’s cyber specialist, George Johnstone, noted, “The server writes the gadget object into wp_give_sessions before returning an HTTP 500.”
Once an attacker requests any front-end webpage with their authentication cookie, the server unserializes the gadget, effectively executing commands dictated by the attacker.
Versions 4.16.6 to 4.16.7.1 remain vulnerable, contingent upon the existence of a legacy donation form lacking ‘formBuilderSettings.’
Patchstack emphasized that such conditions may persist in upgraded installations, sites utilizing the option-based form editor, or in instances involving the import or restoration of outdated forms.
The vulnerability was rectified in version 4.16.7.2, released on August 27, which includes measures to block serialized data during donation processing and constrain object creation at several deserialization junctures.
Furthermore, this security patch also purges serialized object payloads that were previously stored in the affected databases.
Nonetheless, Patchstack highlighted that GiveWP’s registration action still does not comply with WordPress user registration settings, although this flaw is no longer exploitable for code execution.
It is imperative for website administrators utilizing GiveWP to implement the security updates without delay to avert the malicious exploitation of CVE-2026-82222.
Last year, hackers targeted GiveWP, subsequently breaching Pi-hole, a renowned network-level ad blocker, thereby exposing the names and email addresses of approximately 30,000 donors.
Source link: Bleepingcomputer.com.
