GiveWP, the WordPress donation plugin that powers millions of charitable sites, suddenly faces a critical remote-code-execution flaw. CVE-2026-82222 earned a perfect 10.0 on the CVSS and lets anyone on the internet run arbitrary commands on a vulnerable server. The fix lands in version 4.16.7.2.

Why the bug matters

GiveWP sits at the heart of countless fundraising pages. Site owners rely on it to handle donor data, process payments and store session information. An attacker who can execute code on the underlying server can steal credentials, deface the site, or pivot to other parts of the network. Because the vulnerability works without any login, the entire public internet becomes the attack surface.

How the exploit works

The flaw isn’t a single coding error; it’s a chain of three separate issues that together open a back door.

  1. Unsafe deserialization – The plugin’s helper safeUnserialize converts serialized objects into placeholders instead of stripping them, leaving the original object data intact.
  2. Blind re-deserialization – Data pulled from the database is fed back into unserialize without validation, so crafted objects can be resurrected.
  3. TCPDF gadget chain – GiveWP bundles the TCPDF PDF-generation library, which contains a class chain that can invoke system commands once a malicious object is unserialized.

An attacker follows a four-step flow that requires no prior account:

  • Registration – By hooking into the user_register action, the attacker creates a WordPress user even when site registration is disabled.
  • Planting – The attacker stores a serialized payload in the last_name field of the new profile.
  • Poisoning – A donation submission forces the plugin to write that payload into the wp_give_sessions table.
  • Execution – When any public page later reads the session, the malicious object unserializes, the TCPDF gadget chain fires, and the attacker-supplied command runs on the server.

The patch

GiveWP’s developers released version 4.16.7.2 to break the chain at every link:

  • Donations that contain serialized data are rejected outright.
  • All data-reading functions now enforce strict type and content checks.
  • The TCPDF gadget chain is explicitly blocked, preventing unauthorized method calls.
  • Meta fields, including last_name, are sanitized before storage.
  • A database migration runs automatically to scrub any existing malicious payloads.

Updating the plugin is the first step; you must verify that the sanitization migration ran to remove payloads already sitting in your database.

Who’s at risk

Any WordPress site running GiveWP version 4.16.7.1 or earlier is vulnerable, regardless of whether registration is turned on. Large non-profits, small charities, and personal fundraising pages could all be compromised. The attack does not depend on a specific server configuration; any PHP environment that supports the bundled TCPDF library is susceptible.

Counter-point

Some site owners argue the exploit requires a donor to submit a payment, which they see as a low-probability event. The vulnerability disproves that notion: the malicious payload stores during the donation step, but execution occurs on any subsequent page load, even without a completed payment. The unauthenticated nature and the CVSS score of 10.0 make the risk too high to treat as a theoretical concern.

Bottom line

GiveWP’s CVE-2026-82222 shows how a series of seemingly innocuous coding shortcuts can combine into a catastrophic breach. The fix is ready. Site operators should upgrade to 4.16.7.2 immediately, confirm that the migration cleared existing payloads, and monitor logs for signs of post-exploit activity. Ignoring the patch could leave a charitable organization’s web presence—and its donors’ data—exposed to a malicious actor with full server control.