GiveWP, a WordPress donation and fundraising plugin used on hundreds of thousands of nonprofit and charity sites, has patched an unauthenticated remote code execution flaw tracked as CVE-2026-82222 and rated a maximum severity of 10.0. According to an advisory from security research firm Patchstack, the vulnerability chains three separate weaknesses: a broken “safe unserialize” helper meant to neutralize malicious objects, a donation-processing flow that stores attacker-controlled serialized data straight into the plugin’s session table without sanitizing it, and a gadget chain inside GiveWP’s bundled TCPDF library and its own test-data classes that turns object destruction into arbitrary code execution. Patchstack said the flaw requires no authentication and, on default installations running version 4.16.5.1 or earlier, needs nothing more than one published donation form and one active payment gateway to exploit. The vendor shipped version 4.16.7.2 on August 27 closing the chain at multiple layers.
The severity here is not the score, it is the entry point. Most critical WordPress plugin flaws require an authenticated account or a specific configuration; this one lets an anonymous visitor plant the malicious payload through the same donation form a charity’s supporters use every day, then trigger it later without ever logging in. Security teams at any organization running GiveWP, including nonprofits with thin IT staff who may not treat a donation plugin as high-risk software, should confirm they are on 4.16.7.2 or later immediately rather than queuing it into a routine patch cycle.
GiveWP’s disclosure landed in the same week as four other critical, unauthenticated WordPress plugin and theme flaws, the same pattern CyberTech has tracked in unauthenticated, no-login bugs like the three critical ServiceNow flaws disclosed last week. The original insight for defenders is that a 10.0 score no longer tells you what to patch first on its own, a point CyberTech has made before: an unauthenticated, no-interaction bug on internet-facing software like a public donation form should jump the queue ahead of a 10.0 that needs local access, regardless of what the raw score says.
Source: Patchstack
