GiveWP issues accounts to unauthenticated attackers on sites where registration is off
Patchstack chained an unsafe unserialize helper, a donation form and a bundled gadget chain into command execution on more than 100,000 installs. Version 4.16.7.2 closes the execution path and leaves the registration hole.
The Watch · Security desk
What happened
- CVE-2026-82222, a maximum-severity flaw in the GiveWP plugin for WordPress, lets an unauthenticated attacker execute arbitrary commands on the hosting server.
- GiveWP collects donations and manages fundraising campaigns on more than 100,000 WordPress installs, which is the population in scope.
- Patchstack found the plugin exposes an unauthenticated registration action, give_action=user_register, that never consults the WordPress users_can_register option, so an account and cookie can be obtained anyway.
Why it matters
- What it limits constraint Switching off user registration buys nothing on an unpatched site, because the plugin's own registration path does not read the setting that switches it off.
- Who has to decide decision Anyone sitting on 4.16.6 through 4.16.7.1 cannot triage by version number and has to establish whether a legacy donation form without formBuilderSettings exists on the site.
- Who's exposed exposure Payloads already written to the session table make this a persistence problem as well as an execution one, which is why the update has to delete stored serialized objects rather than only reject new ones.
- What it sets up precedent Attackers used GiveWP as an indirect route into Pi-hole's donor records last year, so post-disclosure interest in this plugin is a base rate rather than a hypothetical.
Next story · Security · 4d ago
Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sitesConfirmed3 publishers
The exposed registration action removes the account requirement that was meant to cap this bug. Patchstack's chain stacks three defects: an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain inside libraries the plugin bundles that can invoke arbitrary system commands [5]. The chain needs an account on the target site [6], and that is the precondition the exposed registration action removes.
The request sequence is short. Create the account and collect the authentication cookie, write the serialized gadget into a profile field, then submit a crafted donation. George Johnstone of Patchstack says the server writes the gadget object into wp_give_sessions before returning an HTTP 500 [9]. Fetch any front-end page with the same cookie and the server unserializes the gadget and executes the command [10]. The 500 is therefore a log artifact worth grepping for, as is a new user account on a site whose registration is switched off.
Version triage is messier than "through 4.16.7.1" implies [2]. Patchstack names upgraded installations, sites using the plugin's option-based form editor, and older forms brought back by import or restore as the places that legacy-form condition turns up [14]. Earlier releases narrowed the exploitable population rather than closing the path; 4.16.7.2 blocks serialized data during donation processing and restricts object creation at several deserialization points [11].
Udin Chan reported the chain on July 28 through Patchstack [3]; the fix shipped on August 27 [11]. That is 30 days, assuming both dates fall in the same year, which the source does not state [18]. Nothing in the reporting describes exploitation in the wild [16].
What survives the patch is the registration action itself. Patchstack says it still does not honor the WordPress user registration setting, and says that is no longer exploitable for code execution [15]. The consequence carries forward: the next authenticated-only vulnerability found anywhere in GiveWP starts, from the attacker's side, already authenticated [19]. GiveWP's own registration path keeps handing that head start to whatever bug turns up next in the same codebase.
What to watch
- A GiveWP release note that makes give_action=user_register read the WordPress users_can_register option.
- Scanner traffic for give_action=user_register or new-user creation on sites with registration disabled, which would turn this from disclosure into exploitation.
- Publication of the bundled library and gadget chain, which would shorten weaponisation time for other plugins shipping the same dependency.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption45
- Hype gap+15
- Incentives30
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 40%
- Operator
- Operator 52%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-82222 is a maximum-severity vulnerability in the GiveWP plugin for WordPress that allows an unauthenticated attacker to execute arbitrary commands on the hosting server.
- [2]
CVE-2026-82222 affects GiveWP through version 4.16.7.1.
- [3]
The vulnerability was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.
- [4]
The GiveWP plugin has more than 100,000 installs and is used to collect donations and manage fundraising campaigns.
- [5]
Patchstack says exploitation chains three distinct issues: an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands.
- [6]
Successful exploitation depends on the attacker having an account on the target site.
- [7]
Patchstack says GiveWP exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option, so even on a site with registration disabled an attacker can create an account and receive an authentication cookie.
- [8]
After authenticating, the attacker stores a malicious serialized object in their profile and injects it into the plugin's session database by submitting a crafted donation.
- [9]
George Johnstone, cybersecurity researcher at Patchstack: "The server writes the gadget object into wp_give_sessions before returning an HTTP 500."
- [10]
By requesting any front-end page with the authentication cookie, the server unserializes the gadget and executes the attacker's command.
- [11]
GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing and restricting object creation at several deserialization points.
- [12]
The security update also removes serialized object payloads already stored in affected databases.
- [13]
Versions 4.16.6 through 4.16.7.1 remain vulnerable, although exploitation requires the site to contain a legacy donation form without 'formBuilderSettings'.
- [14]
Patchstack says such conditions may exist in upgraded installations, sites using the plugin's option-based form editor, or when importing or restoring older forms.
- [15]
Patchstack notes GiveWP's registration action still does not honor WordPress user registration settings, but that this issue is no longer exploitable for code execution.
- [16]
The reporting contains no account of CVE-2026-82222 being exploited in the wild.
- [17]
Hackers targeted GiveWP last year to indirectly breach Pi-hole, exposing the names and email addresses of 30,000 donors.
- [18]
The interval between the July 28 report and the August 27 release of 4.16.7.2 is 30 days, assuming both dates fall in the same year, which the source does not state.
- [19]
Because unauthenticated account creation via the GiveWP registration action persists after the 4.16.7.2 patch, any future vulnerability in GiveWP whose only precondition is an authenticated session is reachable without prior credentials.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comGiveWP WordPress donation plugin flaw lets hackers execute server commands
1 article · August 28, 2026
- scworld.comCritical vulnerability in GiveWP plugin allows remote code execution
1 article · August 28, 2026
- securityaffairs.comCritical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
1 article · August 31, 2026
Topics and entities
Topics
- Remote Code Execution Surfaces
- PHP Deserialization and Gadget Chains
- WordPress Plugin Security
Entities
- George Johnstone
- Patchstack
- WordPress