CVE-2026-82222 is a critical, maximum-severity remote code execution vulnerability in the GiveWP donation plugin, caused by unsafe handling of serialized data combined with a flawed deserialization safety mechanism. GiveWP's protective helper uses PHP's allowed_classes => false option, which was intended to reject unsafe objects but instead converts them into __PHP_Incomplete_Class placeholders that retain the original object's data.

The donation workflow allows an attacker to inject a malicious serialized object that survives this initial check and is stored in the wp_give_sessions database table. When it is later retrieved without the same restriction, PHP recreates the original malicious object, and the attacker chains this into arbitrary operating-system command execution using existing code already present in GiveWP, including its TCPDF library component.

The following version(s) are affected:

GiveWP 4.16.7.1 and earlier – (Affected)
GiveWP 4.16.7.2 and later – (Not affected, patched)

The fix was released 27 August 2026. Any site accepting donations through GiveWP should treat this as an urgent, internet-facing risk, since the donation form is by design accessible without authentication.

This flaw requires no authentication and can be triggered through the public donation form on any affected site.

Step 1 - Submit a Crafted Donation Request

An attacker submits a donation request containing a malicious serialized PHP object that passes GiveWP's flawed safety check and is stored in the wp_give_sessions database table.

Step 2 - Trigger Deserialization and Code Execution

When GiveWP later retrieves and deserializes the stored session data without the same restriction, the malicious object is recreated and its gadget chain executes, resulting in arbitrary operating-system command execution with web server privileges.

Attack Vectors

• The public-facing donation form, which is accessible without authentication by design.
• No test mode, open registration, debug mode, or administrator action is required on a default GiveWP installation.

Potential Impact

• Execute arbitrary operating-system commands with the privileges of the web server.
• Achieve full compromise of the WordPress site and, depending on server configuration, the underlying host — with no authentication required at any stage.

CERTVU recommends the following:

1. Update GiveWP immediately

   Upgrade to GiveWP 4.16.7.2 or later without delay, given the maximum CVSS severity and the lack of any precondition to exploit it.

2. Review server logs for donation-form abuse

   Check web server and application logs for unusual or repeated requests to the donation form and related AJAX endpoints prior to the update being applied.

3. Restrict outbound and command execution capability

   Where feasible, restrict the web server process's ability to execute shell commands or make unexpected outbound connections, to limit the impact of any similar future vulnerability.

4. Audit the estate for the affected product

   Identify every WordPress site in the organisation running GiveWP and confirm each has been upgraded to 4.16.7.2 or later.

5. Conduct a compromise assessment

   Given the ease of exploitation, review affected sites for unauthorised files, scheduled tasks, or outbound connections, and engage incident response support if compromise is confirmed.

For further detail, see BleepingComputer: GiveWP WordPress Donation Plugin Flaw Lets Hackers Execute Server Commands.