GiveWP, the WordPress donation and fundraising plugin running on more than 100,000 sites, shipped an emergency patch on August 27 for a PHP object injection flaw tracked as CVE-2026-82222. The bug carries a CVSS score of 10.0, the maximum possible rating, because it lets an unauthenticated attacker run arbitrary commands on the server. Any site with at least one published donation form and an active payment gateway was exposed before the fix. If you run GiveWP, update to version 4.16.7.2 or later now, before you finish reading this.
How the GiveWP Vulnerability Actually Works
According to Patchstack’s advisory, which credited researcher Udin Chan for the report, the flaw chains three separate weaknesses. GiveWP’s donation-processing flow feeds attacker-controlled data from user metadata into a broken unserialize helper that was supposed to sanitize it. That helper hands off to a gadget chain buried in libraries the plugin bundles, including TCPDF, and the end result is arbitrary command execution on the server, no login required.
The registration angle is what makes this worse than a typical plugin bug. GiveWP exposes an unauthenticated registration action even on sites where an admin has turned account registration off in WordPress settings. An attacker can create an account and grab a valid authentication cookie on their own, then walk through the rest of the attack chain from there.
Exploitability shifts a bit by version. On 4.16.5.1 and earlier, a default install with a single published donation form is enough. On 4.16.6 through 4.16.7.1, the window narrows, but Patchstack found that any draft or trashed donation form missing its formBuilderSettings data reopens the same path. Practically, that means version-checking your way to “probably fine” isn’t worth the effort here.
What GiveWP Site Owners Should Do
- Update to GiveWP 4.16.7.2 or later immediately. The official changelog confirms it closes the hole at several independent points: rejecting serialized writes, restricting deserialization, and validating the gadget chain itself.
- Check for admin accounts you don’t recognize and review recent file changes on the server, especially if the site has been running an affected version for a while.
- If you can’t patch right away, take the donation form offline or disable the plugin until you can.
- Confirm any GiveWP add-ons (Stripe, Recurring Donations, Peer-to-Peer) are also current, since they share the same core.
This is the fifth critical WordPress plugin or theme flaw disclosed in the last few days, alongside bugs in WPMU DEV Dashboard, Avada, and TranslatePress, which we covered separately. If your team is maintaining a nonprofit or fundraising site and patch management isn’t happening on a predictable schedule, that’s usually the actual failure mode behind stories like this one, not the vulnerability itself. It’s the kind of gap a WordPress development or plugin audit engagement is built to catch before it turns into an incident.
