Critical GiveWP Plugin Vulnerability Exposes 100K+ WordPress Sites to Remote Code Execution
A critical vulnerability (CVE-2026-82222) in the GiveWP WordPress donation plugin allowed unauthenticated attackers to execute arbitrary commands on hosting servers through a complex chain of PHP deserialization flaws. The vulnerability affected over 100,000 installations running versions 4.16.6 through 4.16.7.1, exploiting unsafe PHP data handling, donation processing flows, and bundled library gadget chains. Attackers could bypass disabled user registration, create accounts, inject malicious serialized objects through crafted donations, and achieve remote code execution when the server processed front-end requests. GiveWP released version 4.16.7.2 on August 27, 2026, addressing the deserialization issues and removing stored malicious payloads from affected databases. This incident highlights the growing sophistication of WordPress plugin vulnerabilities, particularly those targeting donation and e-commerce platforms that handle sensitive financial data. With WordPress powering over 40% of websites and plugin vulnerabilities increasing 35% year-over-year, organizations must prioritize rapid security updates and implement defense-in-depth strategies.
Kill Chain
