Donation plugin flaw hands attackers full control of 100,000 WordPress sites

Key points

• CVE-2026-82222 is a maximum-severity flaw in the GiveWP donation plugin for WordPress, which runs on more than 100,000 websites.
• The bug lets an attacker with no prior access run any command on the site's server.
• Researcher Udin Chan reported it on July 28 through Patchstack; GiveWP patched it in version 4.16.7.2 on August 27.
• Versions up to and including 4.16.7.1 are vulnerable when a legacy donation form is present.
• Site owners should update immediately and check the plugin's session database for leftover malicious data.

A critical flaw in GiveWP, one of the most widely used donation plugins for WordPress websites, lets an outside attacker take over the server the site runs on. Charities, churches and nonprofits are the typical users.

The bug is tracked as CVE-2026-82222 and carries the highest possible severity score. Researcher Udin Chan reported it to the Patchstack vulnerability platform on July 28. GiveWP shipped a fix on August 27 in version 4.16.7.2.

GiveWP is installed on more than 100,000 sites, per the plugin's own listing.

What can an attacker actually do?

Run any command they like on the web server, without needing a password or an existing account. In practice that means stealing donor data, planting malware, or taking the site offline.

The attack, first reported by BleepingComputer, chains together three separate weaknesses in the plugin. Patchstack researcher George Johnstone walked through the sequence.

First, the plugin exposes a hidden sign-up route (give_action=user_register) that ignores WordPress's own setting for whether new accounts are allowed. So even on a site where registration is switched off, an attacker can create an account and get a valid login cookie.

Second, once logged in, the attacker saves a booby-trapped block of data to their profile and submits a specially crafted donation. The plugin writes that block into its own session database.

Third, when the attacker loads any page on the site while carrying their login cookie, the server reads the block back, misinterprets it, and executes whatever command the attacker embedded. The technical name for this trick is a PHP object injection with a gadget chain, meaning the attacker abuses code the plugin already ships with to reach a command execution function.

Which versions are affected?

Every version of GiveWP up to and including 4.16.7.1 is vulnerable. The fixed release is 4.16.7.2, published on August 27.

There is one catch worth flagging (Patchstack raised it in its writeup). Versions 4.16.6 through 4.16.7.1 only expose the full command execution path if the site still has a legacy donation form on it, one built before the plugin's newer form builder. That covers a lot of upgraded sites, sites still using the older option-based editor, and anyone who imported an old form from a backup.

What should site owners do now?

Update GiveWP to 4.16.7.2 today. The patched release also scrubs any malicious data attackers may have already planted in the wp_give_sessions table, which matters if your site was hit before you knew about the bug.

One loose end remains. Patchstack notes that the plugin's rogue registration route still ignores the WordPress "anyone can register" setting even after the patch. It can no longer be used to run commands, but administrators who expect registration to be off should be aware that accounts can still be created through it.

Has GiveWP been abused before?

Yes. Last year attackers used the plugin as a stepping stone to break into Pi-hole, the network-level ad-blocker project, and walked out with the names and email addresses of roughly 30,000 donors. Donation plugins hold real personal data. They are a target.