GiveWP CVE-2026-82222: RCE Chain from Unauthenticated Registration to PHP Object Injection

1. Basic Information

• Article Title: GiveWP WordPress donation plugin flaw lets hackers execute server commands
• Publisher: BleepingComputer
• Publication Date: 2026-08-28
• Original Source: BleepingComputer
• Related Source: Patchstack technical analysis
• Related Malware, Attack Groups, CVEs, Products: CVE-2026-82222, GiveWP, WordPress, TCPDF
• Severity: Critical

2. Executive Summary

In GiveWP versions 4.16.7.1 and earlier, a combination of bypassed configuration settings during account creation, serialized data storage in user profiles, session reconstruction, and TCPDF gadget chains allows unauthenticated attackers to execute OS commands on vulnerable sites.

3. Attack Flow

Attack Steps

1. The attacker creates an account and obtains a cookie using the custom GiveWP registration feature.
2. The attacker saves a PHP serialization gadget into the last_name field.
3. Donation processing converts values into an incomplete object and saves it back to wp_give_sessions.
4. The original object is reconstructed on the next request.
5. The gadget chain reaches call_user_func_array() to execute OS commands.

4. Attacker Position and Execution Environment

• An attacker who can reach the target product and exploit vulnerable functions or improper permission boundaries.
• Operates with application privileges or elevated privileges after a successful exploit.

5. Visibility for Victims and Administrators

Victims

• Appears as normal activity or occurs without user interaction, making it difficult to detect through visual signs alone.

Administrators

• Sequential requests to give_action=user_register, profile updates, and donation/session APIs.
• Accounts created despite disabled users_can_register, along with serialized strings in the last_name field.
• Web server processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.

6. Success and Failure Conditions

Success Conditions

• GiveWP version 4.16.7.1 or earlier is running.
• Custom registration and profile update features are accessible.
• Public or eligible legacy/non-visual forms and payment gateways exist.

Failure Conditions / Risk Mitigation

• Update GiveWP to version 4.16.7.2 or later and complete the migration process.
• Remove suspicious accounts, sessions, and legacy forms.
• Block PHP serialization patterns and OS command execution from web processes.

7. Impact of Successful Exploitation

• Arbitrary command execution with web server process privileges.
• Theft of WordPress settings, donor information, and database credentials.
• Installation of web shells, website defacement, and lateral movement to the same host.

8. Observable Logs

• Email: None.
• Proxy/SWG/DNS: Sequential requests to give_action=user_register, profile updates, and donation/session APIs.
• Endpoint/EDR: Accounts created despite disabled users_can_register, along with serialized strings in the last_name field.
• Identity/IdP: Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
• SaaS/Cloud: Check WAF, load balancers, and audit logs during cloud operations.
• Network: Check for outbound traffic to unknown destinations after successful exploitation.

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): Contact with the target is confirmed, but unauthorized operations or code execution are unconfirmed.
• User Interaction Confirmed: This issue does not require user interaction or can be completed via API operations alone.
• Initial Execution Confirmed: Unauthorized responses, processing, or suspicious child processes are confirmed.
• Information Theft or Session Compromise Confirmed: Unauthorized data retrieval, credential access, or transmission is confirmed.
• Post-Exploitation Confirmed: Additional payloads, persistence, defacement, deletion, or lateral movement is confirmed.

10. Investigation Playbook

• Trigger: Detection of GiveWP, WordPress, or TCPDF vulnerability exploitation or abnormal behavior.
• Initial Verification: Check version, public exposure scope, patch status, initial anomaly timestamp, and source IP. Preserve HTTP, application, and audit logs.
• Endpoint: Accounts created despite disabled users_can_register, along with serialized strings in the last_name field.
• Authentication/Cloud: Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
• Subsequent Operations: Investigate additional files, outbound traffic, credential access, and impact on other assets.
• Containment: Update GiveWP to version 4.16.7.2 or later and complete the migration. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes. Isolate targets and revoke related credentials and sessions if a compromise is confirmed.
• Classification: Distinguish between contact, prerequisite fulfillment, initial success, information compromise, and post-exploitation.

11. Defense and Detection Ideas

• Single Event: Sequential requests to give_action=user_register, profile updates, and donation/session APIs.
• Timeline Correlation: External request or operation -> Vulnerable function -> Arbitrary command execution with web server process privileges -> Correlate subsequent behavior.
• Hunting: Sequential requests to give_action=user_register, profile updates, and donation/session APIs. Accounts created despite disabled users_can_register, along with serialized strings in the last_name field. Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
• Log Gaps: Without correlating timestamps across HTTP, applications, processes, identity, and network logs, it is impossible to determine the success stage.
• Priority Countermeasures: Update GiveWP to version 4.16.7.2 or later and complete the migration. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes.

12. Facts / Inference / Hypothesis

Facts

• give_action=user_register bypassed the WordPress users_can_register setting, allowing attackers to issue accounts and cookies.
• Attackers could save serialization gadgets to their own last_name field, and properties were retained even after incomplete object creation via allowed_classes=false.
• Data was re-saved to wp_give_sessions and reconstructed as the original class on the next request.
• TCPDF and GiveWP ProviderForwarder gadgets reached call_user_func_array() and invoked system().
• Version 4.16.7.2 fixed the issue and migrates existing malicious serialized data.

Inference

• It is necessary to correlate requests, application processing, unauthorized operations, and subsequent behaviors rather than relying on individual IOCs alone.

Hypothesis

• The presence of actual exploitation or additional damage cannot be determined from public information alone.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): In GiveWP versions 4.16.7.1 and earlier, a combination of bypassed configuration settings during account creation, serialized data storage in user profiles, session reconstruction, and TCPDF gadget chains allows unauthenticated attackers to execute OS commands on vulnerable sites.
• T1059 Command and Scripting Interpreter (High): In GiveWP versions 4.16.7.1 and earlier, a combination of bypassed configuration settings during account creation, serialized data storage in user profiles, session reconstruction, and TCPDF gadget chains allows unauthenticated attackers to execute OS commands on vulnerable sites.
• T1505.003 Server Software Component: Web Shell (High): In GiveWP versions 4.16.7.1 and earlier, a combination of bypassed configuration settings during account creation, serialized data storage in user profiles, session reconstruction, and TCPDF gadget chains allows unauthenticated attackers to execute OS commands on vulnerable sites.

14. Unknowns and Additional Investigation

• Presence of actual exploitation and number of compromised sites.
• Whether public, draft, or restored forms meet the vulnerability criteria.

15. Impact on SOCs

Websites using GiveWP are targeted regardless of region. In addition to applying updates, verify unexpected account registrations, profile values, GiveWP sessions, forms, and web process child processes.

16. Summary by Target Audience

• For SOCs: Chronologically review sequential requests to give_action=user_register, profile updates, and donation/session APIs; accounts created despite disabled users_can_register along with serialized strings in the last_name field; and web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
• For Administrators: Update GiveWP to version 4.16.7.2 or later and complete migration. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes.
• For Users: Report any unfamiliar account changes or service anomalies to the management department.