A maximum-severity vulnerability in GiveWP, a WordPress plugin used for donations and fundraising campaigns, can allow attackers to execute arbitrary commands on a hosting server, according to BleepingComputer. The flaw is tracked as CVE-2026-82222 and affects GiveWP through version 4.16.7.1. BleepingComputer reports that GiveWP has more than 100,000 installs. The vulnerability was reported by bug researcher Udin Chan on July 28 through Patchstack’s vulnerability intelligence platform, according to the report. The exploitation path described by Patchstack is notable because it does not begin with normal public access alone. BleepingComputer says successful exploitation depends on the attacker having an account on the target site. Patchstack, however, says GiveWP exposes an unauthenticated registration action, give_action=user_register, that does not consult the WordPress users_can_register option. That means an attacker can create an account even on a site where registration is disabled, receive an authentication cookie, and continue the attack sequence, according to Patchstack as cited by BleepingComputer. After authentication, the attacker can store a malicious serialized object in the user profile and then inject it into the plugin’s session database by submitting a crafted donation. BleepingComputer cites Patchstack researcher George Johnstone saying the server writes the malicious object into wp_give_sessions before returning an HTTP 500 error. A later request to any front-end page using the authentication cookie causes the server to unserialize the object and execute the attacker’s command, according to the report. There is an important scope limit in the affected versions. BleepingComputer reports that GiveWP versions 4.16.6 through 4.16.7.1 remain vulnerable only when the site contains a legacy donation form without formBuilderSettings. Patchstack said those conditions may exist in upgraded installations, sites using the plugin’s option-based form editor, or when older forms are imported or restored. GiveWP fixed CVE-2026-82222 in version 4.16.7.2, released on August 27, according to BleepingComputer. The update blocks serialized data during donation processing, restricts object creation at several deserialization points, and removes serialized object payloads already stored in affected databases. Patchstack also noted that GiveWP’s registration action still does not honor WordPress user registration settings, BleepingComputer reports. The report says that remaining issue is no longer exploitable for code execution after the security update. Site administrators using GiveWP are being urged to apply the security update quickly. BleepingComputer also notes that hackers targeted GiveWP last year in a breach that indirectly affected Pi-hole and exposed the names and email addresses of 30,000 donors. Who benefits: Administrators who update to GiveWP 4.16.7.2 reduce exposure to the reported command-execution path. Attackers would benefit from unpatched sites that meet the legacy-form conditions described by Patchstack. Who's exposed: Sites running affected GiveWP versions through 4.16.7.1 are exposed, especially if they have legacy donation forms without formBuilderSettings. The risk is higher where the unauthenticated registration path can be used to obtain an account cookie.