Unauthenticated PHP object injection allows remote code execution in GiveWP WordPress plugin (CVE-2026-82222)
VulnCheck added this to its known-exploited catalog today with Patchstack reporting exploitation and two public exploits available, so unpatched donation sites are exposed to full unauthenticated takeover right now.
GiveWP versions through 4.16.7.1 deserialize untrusted data, enabling PHP object injection that an attacker with no account can chain to run arbitrary commands on the hosting server. Successful exploitation gives full control of the WordPress site and underlying host.
Affected: GiveWP <= 4.16.7.1
How to Test
In the WordPress admin plugins page (or via WP-CLI plugin list), confirm the installed GiveWP version; anything at or below 4.16.7.1 is vulnerable. Review web server access logs for unexpected unauthenticated POST requests to GiveWP endpoints and for new or modified PHP files as signs of compromise.
How to Patch
Update GiveWP to version 4.16.7.2 immediately. If updating cannot be done right away, deactivate the plugin until the update is applied.