Loading story…
CVE-2026-82222 is a CVSS 10.0 remote-code-execution flaw in the Liquid Web/StellarWP GiveWP WordPress donation plugin affecting versions through 4.16.7.1. Unsafe PHP deserialization can be combined with attacker-controlled donation-session metadata and a gadget chain in bundled TCPDF and GiveWP TestData components to invoke arbitrary server commands. Default installations with a public donation form and active payment gateway are exposed in versions 4.16.5.1 and earlier; later affected versions require specific legacy-form conditions.
GiveWP released 4.16.7.2 to block serialized donation data, restrict deserialization paths, validate gadget-related data, sanitize metadata, and remove previously stored serialized payloads from databases. Administrators should update immediately and review systems for suspicious donation-session records or unexpected server-side command execution. A separate registration-action access-control weakness can still create WordPress accounts while registration is disabled, but it no longer provides an RCE path after the deserialization fix.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Researcher Udin Chan reported the GiveWP insecure-deserialization vulnerability, later assigned CVE-2026-82222, to Patchstack. The flaw affects GiveWP through version 4.16.7.1 and can be chained into remote command execution.
Technical analysis found that CVE-2026-82222 can be exploited without an attacker account, user interaction, or administrator action. Default GiveWP installations through 4.16.5.1 may be directly exploitable with a published donation form, while versions 4.16.6 through 4.16.7.1 retain exploitable paths via legacy donation forms.
Technical reporting described how attackers can obtain an account through an exposed registration action, inject a malicious serialized object through the donation workflow, and trigger its deserialization when a front-end page is requested, resulting in server command execution. The report said more than 100,000 GiveWP installations running versions through 4.16.7.1 are affected.
Patchstack publicly released its advisory for CVE-2026-82222, an unauthenticated PHP object-injection issue in GiveWP that can enable remote code execution. The CVE record was also published and rated Critical with a CVSS v3.1 score of 10.0.
GiveWP released version 4.16.7.2 to address CVE-2026-82222, blocking serialized payloads in donation processing, restricting deserialization and gadget invocation, and removing previously stored serialized-object payloads from affected database records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcepatchstack.com
Open sourcepatchstack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the **GiveWP** WordPress donation plugin exposed more than **100,000 websites** to unauthenticated remote code execution and arbitrary file deletion. The flaw, tracked as **`CVE-2024-5932`** and rated **CVSS 10.0**, affects **GiveWP 3.14.1 and earlier**. Researchers said the bug stems from improper validation and sanitization of the `give_title` parameter in the `give_process_donation_form()` function, enabling **PHP object injection** through unsafe deserialization. Successful exploitation could allow attackers to delete files such as `wpconfig.php`, disclose sensitive information, and potentially take full control of a vulnerable WordPress instance. Wordfence reported a bounty award tied to the discovery and said protections were deployed for its users, while CSIRT.SK urged administrators to **update immediately to GiveWP 3.14.2 or later** to block exploitation.
Jul 24, 2026
A critical vulnerability in the WordPress **W3 Total Cache** plugin allows remote, unauthenticated attackers to execute arbitrary PHP commands on affected sites. Tracked as **`CVE-2025-9501`**, the flaw affects versions earlier than **`2.8.13`** and is tied to insufficient validation of user input in the plugin’s **`_parse_dynamic_mfunc()`** function. According to CSIRT.SK, the bug can be triggered through a specially crafted comment, creating a path to full system compromise on vulnerable WordPress installations. The issue carries a **CVSS v3 score of 9.0**, underscoring the risk to organizations running the plugin in production. Security updates were released by the vendor in **W3 Total Cache 2.8.13**, and defenders are being urged to upgrade immediately and review WordPress databases, site files, and logs for evidence of exploitation or malicious post-compromise activity.
Jul 24, 2026
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 16, 2026