Critical RCE Vulnerability in GiveWP Plugin Exposed

• •CVE-2026-82222 allows unauthenticated RCE in GiveWP plugin versions up to 4.16.7.1.
• •Attackers can exploit the vulnerability without an existing account due to a registration flaw.
• •Patch 4.16.7.2 released on August 27 mitigates the vulnerability but retains a registration issue.

A critical vulnerability (CVE-2026-82222) in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary commands on affected servers. The flaw, discovered by Udin Chan and reported to Patchstack, affects versions up to 4.16.7.1 and can be exploited without prior authentication due to an unauthenticated registration action. Attackers can chain multiple issues, including a broken unserialize helper and a gadget chain, to achieve remote code execution. GiveWP has over 100,000 installations, primarily used by nonprofits for fundraising. The vulnerability was patched in version 4.16.7.2, released on August 27, 2026, which blocks serialized data during donation processing. Despite the patch, the registration action still does not respect WordPress user settings, but it is no longer exploitable for code execution. Administrators are urged to update immediately to prevent exploitation.