CVE-2026-82222: GiveWP Object Injection Vulnerability

CVE-2026-82222 Overview

CVE-2026-82222 is an unauthenticated PHP object injection vulnerability in the GiveWP WordPress plugin from Liquid Web / StellarWP. The flaw is a deserialization of untrusted data issue [CWE-502] that attackers can chain into remote code execution on affected sites. All GiveWP versions up to and including 4.16.7.1 are impacted. Because the plugin is widely deployed for donation and fundraising workflows, exploitation exposes payment data, site administration, and the underlying web server.

Critical Impact
Unauthenticated attackers can trigger PHP object injection over the network and achieve remote code execution on WordPress sites running vulnerable GiveWP releases.

Affected Products

GiveWP WordPress plugin, versions up to and including 4.16.7.1
WordPress sites using Liquid Web / StellarWP GiveWP for donation processing
Any environment where the vulnerable plugin is network-reachable

Discovery Timeline

2026-08-28 - CVE-2026-82222 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82222

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw classified under [CWE-502]. GiveWP processes attacker-controlled input through PHP's unserialize() function without validating the object graph. Any class with a magic method such as __destruct(), __wakeup(), or __toString() that is loaded in the WordPress runtime becomes a potential gadget. Attackers combine these gadgets into a chain that culminates in arbitrary code execution inside the PHP process.

Root Cause

GiveWP accepts serialized PHP data on an unauthenticated code path and passes it directly to unserialize(). The plugin does not enforce an allow-list of classes and does not validate input format before deserialization. This behavior lets an attacker instantiate arbitrary objects and control their properties, satisfying the preconditions for object injection.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted HTTP request containing a serialized PHP payload to a vulnerable GiveWP endpoint. When the plugin deserializes the payload, the attacker-supplied gadget chain executes and reaches functions capable of running system commands or writing PHP files to disk. Public analysis of the exploitation path is documented in the Patchstack advisory on unauthenticated PHP object injection to RCE in GiveWP.

No verified public proof-of-concept code is included with this advisory. Refer to the vendor and third-party technical write-ups for payload structure and gadget details.

Detection Methods for CVE-2026-82222

Indicators of Compromise

HTTP POST requests to GiveWP endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names
Unexpected PHP files written under wp-content/uploads/ or the GiveWP plugin directory
New WordPress administrator accounts, altered wp-config.php, or scheduled tasks created without an audit trail
Outbound connections from the web server to unfamiliar hosts shortly after donation-related traffic

Detection Strategies

Inspect web server and WAF logs for request bodies containing PHP serialization tokens directed at /wp-admin/admin-ajax.php or GiveWP REST routes
Alert on the php process spawning child processes such as sh, bash, curl, wget, or python on hosts running WordPress
Monitor file integrity on the WordPress installation and flag new or modified .php files in writable directories

Monitoring Recommendations

Forward WordPress, PHP-FPM, and WAF logs to a centralized analytics platform and retain them for post-incident review
Baseline normal donation traffic patterns and alert on anomalous request sizes or serialized payloads
Track plugin version inventory across WordPress fleets so vulnerable GiveWP instances are visible to the SOC

How to Mitigate CVE-2026-82222

Immediate Actions Required

Update GiveWP to a version later than 4.16.7.1 as soon as the vendor patch is available
Take vulnerable sites offline or disable the GiveWP plugin if immediate patching is not possible
Rotate WordPress administrator credentials, API keys, and payment gateway secrets on any host suspected of compromise
Review web server file systems for webshells and unauthorized modifications before returning sites to production

Patch Information

Refer to the Patchstack database entry for the GiveWP 4.16.7.1 RCE vulnerability for the current fixed version and vendor advisory links. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI.

Workarounds

Deploy a Web Application Firewall rule that blocks request bodies containing PHP serialization patterns targeting GiveWP endpoints
Restrict access to the WordPress admin and GiveWP REST routes by source IP where feasible
Disable the GiveWP plugin until the site can be patched and validated

bash

# Update GiveWP via WP-CLI once a fixed release is published
wp plugin update give --version=<fixed-version>
wp plugin list --name=give --fields=name,status,version