As cited
Copy frozen at (site build).
vulnerabilities
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
CVE-2026-82222 is a critical unauthenticated remote code execution vulnerability in GiveWP versions 4.16.7.1 and below that exploits unsafe PHP object deserialization combined with a gadget chain in shipped libraries. An attacker can register an account without authentication, plant a malicious serialized object in user metadata, and trigger execution through the donation flow. GiveWP released version 4.16.7.2 on August 27, 2026, which closes the vulnerability at five independent points: rejecting serialized data in write paths, restricting deserialization at read sinks, validating gadget chain callables, sanitizing name fields, and migrating existing poisoned data in the database.
Why it matters: WordPress site administrators running GiveWP must update immediately to version 4.16.7.2, as unauthenticated attackers can achieve remote code execution on default installations with a published donation form and active payment gateway.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
CVE-2026-82222 is a critical unauthenticated remote code execution vulnerability in GiveWP versions 4.16.7.1 and below that exploits unsafe PHP object deserialization combined with a gadget chain in shipped libraries. An attacker can register an account without authentication, plant a malicious serialized object in user metadata, and trigger execution through the donation flow. GiveWP released version 4.16.7.2 on August 27, 2026, which closes the vulnerability at five independent points: rejecting serialized data in write paths, restricting deserialization at read sinks, validating gadget chain callables, sanitizing name fields, and migrating existing poisoned data in the database.
Why it matters: WordPress site administrators running GiveWP must update immediately to version 4.16.7.2, as unauthenticated attackers can achieve remote code execution on default installations with a published donation form and active payment gateway.
- Source published
- First seen by Cybersecurity Tracker