Ethical Hacking News
A critical vulnerability in the GiveWP plugin, a widely used WordPress plugin for online donations and fundraising, can allow unauthenticated attackers to execute server commands on WordPress servers, compromising the server's security. This vulnerability is due to the plugin's use of PHP's unserialize() function, which is not properly sanitized. The issue has been fixed in GiveWP version 4.16.7.2, but users are advised to update to the latest version and review logs and signs of compromise.
The GiveWP plugin has a critical flaw that can allow unauthenticated attackers to execute server commands, compromising the security of the server. The vulnerability is due to the plugin's use of PHP's unserialize() function, which is not properly sanitized. The issue is severe because the plugin's registration feature ignores WordPress's users_can_register setting, allowing attackers to create accounts even when registration is disabled. Exploiting the vulnerability requires creating a new donation form on a default installation of GiveWP 4.16.5.1 or earlier. The vulnerability is fixed in GiveWP version 4.16.7.2, which includes several security patches. The impact of this vulnerability can extend beyond the GiveWP plugin itself, posing a significant risk if WordPress has access to sensitive files or resources.
The latest data extraction reveals a critical flaw in the GiveWP plugin, a popular WordPress plugin for online donations and fundraising. This vulnerability, tracked as CVE-2026-82222, can allow unauthenticated attackers to execute server commands on WordPress servers, effectively compromising the security of the server.
The GiveWP plugin, designed for nonprofits and other organizations that collect donations through WordPress, contains a PHP object injection vulnerability that can be chained into full remote code execution. The vulnerability is due to the plugin's use of PHP's unserialize() function, which is not properly sanitized. This allows an attacker to inject malicious data into the plugin's storage, which can then be executed on the server.
The issue is particularly severe because the plugin's registration feature ignores WordPress's users_can_register setting, allowing attackers to create accounts even when registration is disabled. Additionally, the plugin's donation process allows attackers to move malicious data into the plugin's session storage, which can then be processed by the server.
To exploit this vulnerability, an attacker only needs to create a new donation form on a default installation of GiveWP 4.16.5.1 or earlier. The attacker can then obtain and reuse the nonce on sites with the public registration shortcode, allowing them to create accounts and inject malicious data into the plugin's storage.
The vulnerability is fixed in GiveWP version 4.16.7.2, which includes several security patches, including the blocking of serialized data before storage, limiting where stored data can be deserialized, hardening the vulnerable gadget, and sanitizing donor and billing metadata.
The impact of this vulnerability is significant, as it can extend beyond the GiveWP plugin itself. If the WordPress process has access to sensitive files, databases, or other internal resources, the impact can be severe. Therefore, it is essential for WordPress users to update to the latest version of GiveWP and review logs and signs of compromise.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-GiveWP-Flaw-Leaves-WordPress-Servers-Vulnerable-to-Remote-Code-Execution-ehn.shtml
https://securityaffairs.com/198156/security/critical-givewp-flaw-lets-attackers-run-commands-on-wordpress-servers.html
https://nvd.nist.gov/vuln/detail/CVE-2026-82222
https://www.cvedetails.com/cve/CVE-2026-82222/
Published: Mon Aug 31 04:34:55 2026 by llama3.2 3B Q4_K_M
