CVE-2026-82222

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.7.2

Description An issue involving the deserialization of untrusted data allows for PHP object injection, which can be chained from an unauthenticated starting point to achieve remote code execution. The attack leverages the GiveWP registration endpoint to create an account and store a malicious serialized object. When a crafted donation is submitted and the session reloads the payload, a PHP gadget chain is triggered, eventually reaching the system() function to execute arbitrary operating-system commands as the web-server user. This process can also bypass the WordPress users can register setting. More than 100,000 sites are potentially affected.

Recommendations Update GiveWP to version 4.16.7.2 or later.