Clarissa Hana
A critical security vulnerability identified as CVE-2026-82222 has been discovered in the widely-used GiveWP WordPress plugin, potentially allowing unauthenticated attackers to execute arbitrary commands on the hosting server. The vulnerability, affecting GiveWP versions up to and including 4.16.7.1, was initially reported on July 28 by bug researcher Udin Chan through the Patchstack vulnerability intelligence platform. GiveWP, a popular plugin with over 100,000 active installations, is designed to facilitate online donations and manage fundraising campaigns, making its compromise a significant concern for non-profit organizations and other entities relying on it for their operations.
The Complex Chain of Exploitation
Patchstack researchers have detailed a multi-stage attack vector that, when chained together, can lead to remote code execution. The exploitation process, while requiring a specific set of circumstances, is particularly concerning due to its ability to bypass standard security measures.
The first critical element of the attack involves an unauthenticated user registration action exposed by GiveWP, identified as give_action=user_register. This action, alarmingly, does not respect the WordPress global setting for user registration. Even on websites where new user registrations are explicitly disabled in WordPress settings, this GiveWP function can be exploited. As explained by Patchstack: "[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option." This means an attacker, regardless of their initial access level, can create a legitimate user account on the target WordPress site.
Upon successfully creating an account, the attacker receives an authentication cookie. This cookie grants them the necessary privileges to proceed with the subsequent stages of the attack. The next phase involves the attacker storing a malicious serialized object within their newly created user profile. This is achieved by submitting a specially crafted donation through the GiveWP plugin. During this process, the plugin inadvertently stores the serialized object in its session database, specifically within the wp_give_sessions table. George Johnstone, a cybersecurity researcher at Patchstack, elaborated on this step: "The server writes the gadget object into wp_give_sessions before returning an HTTP 500." This error response, while indicating a problem, paradoxically confirms the successful injection of the malicious data.
The final step in the exploit chain leverages the server’s deserialization process. By simply requesting any front-end page on the compromised website while authenticated with the stolen cookie, the server attempts to process the session data. During this process, it encounters the injected serialized object. The server’s deserialization mechanism, when encountering this malformed or malicious object, is tricked into executing the arbitrary commands embedded within it. This effectively grants the attacker the ability to run commands directly on the server hosting the WordPress site.
Identifying the Vulnerable Versions and Conditions
The vulnerability specifically impacts GiveWP versions 4.16.6 through 4.16.7.1. However, the exploitation is not universally applicable to all installations of these versions. A crucial prerequisite for successful exploitation is the presence of a legacy donation form that lacks the formBuilderSettings option.
Patchstack researchers have noted that such legacy forms might still exist in several scenarios:
- Upgraded Installations: Websites that have been upgraded from older versions of WordPress or the GiveWP plugin might retain older form configurations.
- Option-Based Form Editor: Users who utilize the plugin’s option-based form editor, which might not fully implement or enforce the newer settings, could also be susceptible.
- Imported or Restored Forms: If older forms were imported or restored from backups, they might also fall into the category of lacking the necessary
formBuilderSettings.
This nuanced requirement means that while not every GiveWP installation is at immediate risk, a significant number of sites that have not recently updated or reconfigured their forms could be vulnerable. The existence of these older form configurations provides an attack surface that threat actors can actively probe.
The Patch and Mitigation Efforts
GiveWP has responded swiftly to the discovery of this critical vulnerability. The security issue was addressed in version 4.16.7.2, which was released on August 27. The fix implemented in this update involves several key changes:
- Blocking Serialized Data: The plugin now actively blocks serialized data from being processed during donation submissions, preventing the injection of malicious objects.
- Restricting Object Creation: Safeguards have been put in place to restrict the creation of objects at various deserialization points within the plugin’s code.
- Removal of Existing Payloads: Importantly, the security update also includes measures to identify and remove any malicious serialized object payloads that may have already been stored in affected databases from previous successful attacks.
While the core remote code execution vulnerability has been patched, Patchstack has observed that the unauthenticated registration action within GiveWP still does not fully adhere to WordPress’s user registration settings. However, they emphasize that this specific issue is no longer exploitable for code execution purposes following the implemented security fixes.
Broader Implications and Past Incidents
The discovery of CVE-2026-82222 highlights the persistent threat posed by vulnerabilities in widely-used WordPress plugins. With over 100,000 installations, GiveWP serves a critical function for many organizations, and a compromise could have far-reaching consequences.
This incident is not the first time GiveWP has been implicated in security breaches. In a notable event last year, hackers targeted a vulnerability in GiveWP to gain indirect access to Pi-hole, a popular network-level ad-blocking software. This attack resulted in the exposure of the names and email addresses of approximately 30,000 Pi-hole donors. This past incident serves as a stark reminder of the potential impact of such flaws and the importance of maintaining robust security practices for plugins that handle sensitive user data and system access.
The implications of an unauthenticated remote code execution vulnerability are severe. Attackers gaining such access could:
- Deface Websites: Alter the content or appearance of the compromised website.
- Steal Sensitive Data: Access and exfiltrate user data, financial information, or other confidential content stored on the server.
- Install Malware: Deploy malicious software, such as backdoors, ransomware, or cryptominers, on the server.
- Launch Further Attacks: Use the compromised server as a launchpad to attack other systems, participate in botnets, or distribute spam.
- Disrupt Operations: Cause significant downtime and operational disruption for the website and its associated services.
Given the potential for such severe damage, website administrators utilizing GiveWP are strongly urged to update to version 4.16.7.2 or a later version immediately. This proactive step is crucial to safeguard their websites and the data of their donors and supporters. Regular security audits, prompt application of updates, and the use of reputable security plugins can further bolster defenses against such sophisticated threats. The cybersecurity landscape is constantly evolving, and vigilance is paramount for maintaining the integrity and security of online platforms.
