Donation plugin flaw hands attackers full control of 100,000 WordPress sites

Key points

• CVE-2026-82222 is a maximum-severity flaw in the GiveWP donation plugin for WordPress, which runs on more than 100,000 websites.
• The bug lets an attacker with no prior access run any command on the site's server.
• Researcher Udin Chan reported it on July 28 through Patchstack; GiveWP patched it in version 4.16.7.2 on August 27.
• Versions up to and including 4.16.7.1 are vulnerable when a legacy donation form is present.
• Site owners should update immediately and check the plugin's session database for leftover malicious data.

A critical flaw in GiveWP, one of the most widely used donation plugins for WordPress, lets an outside attacker take over the server the site runs on. Nonprofits and donation-dependent organisations are squarely in the crosshairs.

The bug is tracked as CVE-2026-82222 and carries the highest possible severity score. Researcher Udin Chan reported it to the Patchstack vulnerability platform on July 28. The fix, version 4.16.7.2, shipped on August 27. GiveWP is installed on more than 100,000 sites per the plugin's own listing, and it's the third WordPress plugin code-execution flaw we've reported in a month, following our 17 August story on Forminator and the Elementor Pro file-upload bug on 20 August.

What can an attacker actually do?

Run any command they like on the web server without a password or an existing account. That means donor data stolen or the site taken offline entirely.

The attack, first reported by BleepingComputer, chains three separate weaknesses. Patchstack researcher George Johnstone walked through the sequence.

First, the plugin exposes a hidden sign-up route (give_action=user_register) that ignores WordPress's own setting for whether new accounts are allowed. Even on a site where registration is switched off, an attacker can create an account and receive a valid login cookie.

Second, once logged in, the attacker saves a booby-trapped block of data to their profile and submits a specially crafted donation. The plugin writes that block into its own session database.

Third, when the attacker loads any page on the site while carrying their cookie, the server reads the block back and executes whatever command the attacker embedded. The technical name is PHP object injection with a gadget chain: the attacker abuses code the plugin already ships with to reach a command execution function.

Which versions are affected?

Every version up to and including 4.16.7.1 is vulnerable. The fixed release is 4.16.7.2, published on August 27.

One condition applies to versions 4.16.6 through 4.16.7.1: the full command-execution path only opens if the site still has a legacy donation form, one built before the plugin's newer form builder. That covers upgraded sites still using the older option-based editor, and anyone who imported a form from a backup.

What should site owners do now?

Update to 4.16.7.2 today. The patch also scrubs any malicious data already planted in the wp_give_sessions table, which matters if your site was exposed before you caught this.

One loose end: Patchstack notes the plugin's rogue registration route still ignores the WordPress "anyone can register" setting even after the patch. It can't be used to run commands now, but administrators who expect registration to be closed should know accounts can still be created through it.

Has GiveWP been abused before?

Yes. Last year attackers used the plugin as a path into Pi-hole, the network-level ad-blocker project, and walked out with the names and email addresses of roughly 30,000 donors. Donation plugins hold real personal data and they're a consistent target. The pattern here, an unauthenticated registration bypass chained into object injection, is exactly the kind of multi-step exploit defenders tend to underestimate until it's too late.