Loading vulnerability…
CVE-2026-82222 is a critical insecure PHP deserialization vulnerability in the Liquid Web / StellarWP GiveWP WordPress donation and fundraising plugin through version 4.16.7.1. GiveWP processed attacker-controlled serialized data with a restricted unserialization setting that converted objects to incomplete-class instances but retained their original class names and properties when reserialized. The preserved payload could later reach deserialization paths without equivalent class restrictions. An attacker could poison donor metadata and donation-session data, then use a gadget chain involving TCPDF and GiveWP TestData components to invoke an attacker-controlled callable. The documented chain can invoke system() to execute operating-system commands.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This 16-file repository is a functional, single-target proof of concept and reproducible DDEV lab for CVE-2026-82222 in the GiveWP WordPress donation plugin. The primary exploit implementations are poc/poc.py (Python requests-based tool, including a non-exploit --check fingerprint mode) and poc/cve-2026-82222.sh (cURL/Bash runner). Both automate registration through GiveWP's exposed user_register action, authenticated profile modification to plant a TCPDF/Symfony/DonorFactory serialized PHP gadget, donation submission without give_last to serialize the gadget into a GiveWP session, and receipt/root requests that trigger unrestricted unserialization and system() execution. Commands are configurable but constrained by the encoding strategy; output is returned in the triggering HTTP response. The lab directory provisions WordPress, vulnerable GiveWP 4.16.5.1, a legacy donation form, manual gateway, and a registration nonce page; its scripts can swap tested GiveWP versions including patched 4.16.7.2. Documentation provides technical chain analysis, cURL and Burp workflows, version reachability conditions, persistence artifacts, and cleanup guidance.
The repository contains a single 32 KB Python 3 exploit program and a large HTML-formatted README. It is a standalone, command-line proof-of-concept/operational batch exploitation tool rather than a module for Metasploit, Nuclei, or another recognized framework. The Python script targets CVE-2026-82222 in the GiveWP WordPress plugin. Its documented four-stage chain registers a WordPress user without authentication, writes a serialized PHP object graph into that account's last_name metadata, submits a donation without the give_last field so GiveWP retrieves and stores the value in session state, then sends receipt/root trigger requests that deserialize the stored object. The intended POP chain reaches PHP system() through call_user_func_array, placing command output in the final HTTP response. The program supports single-target and file-based batch operation, concurrent execution through ThreadPoolExecutor, version/reachability checks, automatic form-ID discovery using page-content regexes, candidate payment-gateway selection, donation amount tests, configurable trigger retries/timeouts, and JSON/TXT result export. The README advertises additional webshell and administrator-escalation features, but those capabilities cannot be confirmed from the visible Python source excerpt; the code header specifically emphasizes in-response system-command output and states that nothing is written to disk. No hard-coded victim domain, IP address, listener, or exfiltration/C2 service is present; targets are supplied by the operator.
This two-file repository contains a standalone Python 3 exploit program and a README. The executable, CVE-2026-82222.py, is a requests-based command-line mass-exploitation tool with single-target and file-based batch modes, configurable thread count, timeout and proxy support, retry handling, colored progress output, and JSON/TXT reporting. It claims to target CVE-2026-82222 in the WordPress GiveWP plugin via unauthenticated PHP object injection/deserialization. Its stated attack chain fingerprints GiveWP, creates a WordPress account when permitted, stores a Base64-encoded serialized TCPDF POP-chain payload in a profile field, discovers a donation form and viable payment gateway, then triggers donation processing to execute a supplied command. Candidate trigger locations include receipt routes, the WordPress AJAX receipt action, the site root, and /donations/. The repository is not a Metasploit, Nuclei, or other recognized framework module; it is an operational standalone exploit script.
This is a small standalone Python 3 proof-of-concept repository consisting of an MIT license, a README, and cve-2026-82222.py (the sole executable/code file). It uses the requests library and argparse to target a caller-supplied WordPress base URL, optionally discover a donation form and active payment gateway, fingerprint the GiveWP version, and execute a four-stage unauthenticated PHP object-injection chain. First, it abuses GiveWP's user_register action to create an account despite WordPress registration settings; second, it updates last_name through the standard WordPress profile endpoint with a serialized PHP gadget; third, it submits a donation without give_last, causing vulnerable GiveWP processing to retrieve the malicious metadata and preserve the serialized object in wp_give_sessions; finally, it sends one or more session-bearing trigger requests to deserialize the session and activate a TCPDF/Symfony/Give POP chain ending in system(command). It is a genuine RCE exploit rather than merely a detection utility, although --check supports version-only fingerprinting. It is not part of Metasploit, Nuclei, or another identified exploitation framework.
This 10-file repository is a functional proof-of-concept and isolated validation lab for reported CVE-2026-82222, an unauthenticated PHP object-injection-to-RCE issue in GiveWP. The primary standalone exploit, CVE-2026-8222-RCE.py (note the filename uses 8222 while the code, README, and CVE references consistently identify CVE-2026-82222), is a requests-based multi-target web exploit. It registers a GiveWP user despite normal WordPress registration being disabled, uses the authenticated profile route to plant a NUL-free serialized object graph in last_name metadata, obtains a donation nonce, invokes give_process_donation without a normal give_last value, and sends a trigger request. The intended deserialization path reaches a TCPDF destructor and a Symfony Session/DonationFactory gadget chain ending in system(command). Unlike the lab documentation's marker-only claim, this standalone file exposes a configurable --cmd option and defaults to id, making it an arbitrary single-line command execution PoC subject to its character restrictions. The poc/ directory contains a safer validation implementation. poc/poc.py reproduces the HTTP chain but hardcodes a touch marker and enforces same-origin redirects plus loopback scope unless explicitly overridden. direct-pop-control.php directly unserializes the terminal gadget in the container to distinguish an ingress fix from a gadget-chain fix. The lab Bash entry point orchestrates disposable Docker deployments, installs a deterministic donation form, and tests GiveWP 4.16.5.1 as vulnerable versus 4.16.7.2 as patched. docker-compose.yml defines MySQL 8 and WordPress 6.6.2/PHP 8.1, with WordPress published only to 127.0.0.1. scripts/fetch-assets.sh downloads and SHA-256-verifies the two official plugin releases before each deployment. GitHub Actions performs syntax/Compose checks and runs the positive/negative lab matrix. No reverse shell, callback infrastructure, persistence, privilege escalation, container escape, or host-compromise capability is present in the provided lab harness.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A CVE record referenced in a pull-request conversation; the content provides no technical details about the vulnerability, affected products, impact, or remediation.
A critical unauthenticated PHP object-injection vulnerability in the GiveWP WordPress donation and fundraising plugin. Attacker-controlled serialized objects can persist through supposedly safe deserialization and later be rehydrated, enabling a gadget chain involving TCPDF and GiveWP classes to invoke system() and execute OS commands as the web-server user.
A critical unauthenticated arbitrary system command-execution vulnerability in the GiveWP WordPress plugin. It chains unsafe PHP deserialization, attacker-controlled serialized-object storage during donation processing, and a bundled-library gadget chain. Attackers can create an account through an exposed registration action, inject a malicious serialized object through a crafted donation, and trigger command execution when a front-end page causes the server to unserialize the object.
A maximum-severity remote code execution vulnerability in the GiveWP WordPress plugin. Attackers can abuse an exposed registration action to create an account even where site registration is disabled, submit a crafted donation that stores a malicious serialized object in the plugin session database, and trigger unsafe deserialization through a front-end request to execute arbitrary system commands.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.