Full Report
A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. [...]
Analysis Summary
# Vulnerability: Unauthenticated PHP Object Injection to RCE in GiveWP
## CVE Details
- **CVE ID:** CVE-2026-82222
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** GiveWP WordPress Plugin
- **Versions:** Up to and including version 4.16.7.1
- **Configurations:**
- Specifically impacts versions 4.16.6 through 4.16.7.1.
- Vulnerable conditions include upgraded installations, sites using the legacy option-based form editor, or environments where older forms were imported/restored (lacking `formBuilderSettings`).
## Vulnerability Description
The flaw is a PHP Object Injection vulnerability that leads to Remote Code Execution (RCE). It is achieved by chaining three distinct issues:
1. **Broken Access Control:** The plugin exposes an unauthenticated registration action (`give_action=user_register`) that bypasses the global WordPress `users_can_register` setting, allowing attackers to gain an authentication cookie.
2. **Unsafe Deserialization:** A donation-processing flow stores attacker-controlled serialized objects in the `wp_give_sessions` database table.
3. **Gadget Chain:** Bundled libraries contain a gadget chain that, when unserialized, invokes arbitrary system commands on the hosting server.
## Exploitation
- **Status:** PoC described by researchers; historically, GiveWP has been targeted in the wild (e.g., Pi-hole breach).
- **Complexity:** Low (Attacker creates an account via the bypass, then submits a crafted donation).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full server access/data theft)
- **Integrity:** High (Arbitrary command execution)
- **Availability:** High (Potential for server takeover or denial of service)
## Remediation
### Patches
- **Update to GiveWP version 4.16.7.2 or higher.**
- The patch blocks serialized data during donation processing, restricts object creation at deserialization points, and actively scrubs existing malicious payloads from the database.
### Workarounds
- No specific workarounds are provided other than patching. Administrators should verify if they are using legacy forms and prioritize updates if `formBuilderSettings` are absent.
## Detection
- **Indicators of Compromise:**
- Monitor for unexpected user registrations via `give_action=user_register`.
- Inspect the `wp_give_sessions` table for serialized PHP objects containing system-level commands (e.g., `exec`, `system`, `passthru`).
- Check server logs for HTTP 500 errors occurring immediately after donation submissions.
- **Detection methods and tools:**
- WordPress security scanners (Patchstack, Wordfence).
- Database integrity audits for the `wp_give_sessions` table.
## References
- **Vendor/Researcher Advisories:**
- hxxps[://]patchstack[.]com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/
- **Relevant News:**
- hxxps[://]www[.]bleepingcomputer[.]com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/
- hxxps[://]www[.]bleepingcomputer[.]com/news/security/pi-hole-discloses-data-breach-via-givewp-wordpress-plugin-flaw/