GiveWP: Maximum-Severity Remote Code Execution (CVSS 10.0, CVE-2026-82222)

Introduction

GiveWP, a donation and fundraising plugin with more than 100,000 active installations, had a vulnerability disclosed with a maximum CVSS score of 10.0 — the highest possible rating. Tracked as CVE-2026-82222, it’s a PHP Object Injection flaw that chains a broken “safe unserialize” helper, a donation flow that feeds it attacker-controlled data, and a gadget chain shipped inside GiveWP itself, ultimately allowing arbitrary command execution on the server.

Any site with at least one published donation form and one active payment gateway is exposed. No account or user interaction is required — and to make matters worse, GiveWP exposes an unauthenticated registration action that ignores WordPress’s own “disable public registration” setting, so even sites that believe registration is locked down aren’t protected from the attacker step that sets up the exploit.

The fix shipped in version 4.16.7.2, which blocks serialized data during donation processing and restricts object creation.

What You Should Do Right Now

1. Check if GiveWP is installed under Plugins in wp-admin, and confirm the version.
2. Back up your site immediately before updating.
3. Update to 4.16.7.2 or later right away.
4. Check your user list for any accounts you don’t recognize — remember, the unauthenticated registration bypass means an attacker could have created an account even if you thought registration was disabled.
5. Review your server for unfamiliar files or processes if you suspect the site was already probed before you could patch.

Why a Perfect 10.0 Score Matters Here

A CVSS 10.0 rating means every dimension of severity maxed out at once: no privileges needed, no user interaction needed, and full impact on confidentiality, integrity, and availability. Combined with GiveWP’s popularity on donation-driven sites — nonprofits, campaigns, community organizations, often run by small teams without dedicated security staff — this is exactly the kind of vulnerability that gets automated and scanned for at scale within hours of disclosure.

FAQ

Do I need to have received a donation to be at risk?
No — simply having one published donation form and one active payment gateway is enough for the site to be exposed, regardless of donation volume.

How do I know if an attacker used the registration bypass?
Check your Users list for accounts created around or after the disclosure date that you don’t recognize, even if you have public registration disabled in Settings.

Is the free or Pro version of GiveWP affected?
Check your installed version against 4.16.7.2 regardless of which edition you run.

Conclusion

A maximum-severity, unauthenticated remote code execution flaw on a plugin that handles real donations is as urgent as it gets. Update to 4.16.7.2+ immediately, back up first, and check your user list for signs of prior access.