CVE Tools
Sign in
Back to feed
Research GiveWP WordPress Plugin web-app GiveWP rce

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack·By Patchstack··10 min read
CVE Tools coverage

GiveWP has released version 4.16.7.2 to remediate CVE-2026-82222, a critical vulnerability allowing unauthenticated attackers to achieve remote code execution on WordPress sites. The flaw stems from an unsafe unserialize helper that fails to neutralize malicious objects, combined with a gadget chain in the plugin's bundled libraries. Users of versions 4.16.7.1 and below, particularly those operating default installations or specific form configurations, should update immediately to close this attack vector.


GiveWP

Unauthenticated PHP Object Injection to Remote Code Execution

This blog post is about an unauthenticated remote code execution vulnerability in the GiveWP plugin. An attacker with no account can run arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway which, on the versions where the chain is fully reachable, describes a default installation.…

Continue reading on Patchstack

Related coverage

Other stories on the same CVEs
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure