Quick answers
- Is CVE-2026-82222 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82222 being exploited in the wild.
- How severe is CVE-2026-82222?
- Critical severity, with a CVSS score of 10, published 28 August 2026.
- Which products and versions are affected?
- StellarWP GiveWP through 4.16.7.1.
- Is there a fix for CVE-2026-82222?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82222 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82222?
- Check whether you run StellarWP GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability combines three weaknesses: (1) an unsafe "safe" unserialize helper in src/Helpers/Utils.php that uses allowed_classes=false, which does not neutralize untrusted objects but merely converts them to __PHP_Incomplete_Class placeholders that retain the original class name and properties; (2) a donation processing flow that accepts and deserializes user-controlled data from user meta fields (last_name) without proper sanitization; and (3) gadget chains in GiveWP's codebase that can be exploited upon deserialization. The attack is unauthenticated on default installations (versions 4.16.5.1 and below require only a published donation form and active payment gateway). Exploitation triggers remote code execution via the chained gadget chain when session data is unserialized on subsequent requests.
Affected products
- StellarWP GiveWP through 4.16.7.1
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory