# CVE-2026-82222: StellarWP GiveWP PHP object injection to RCE

Source: https://junglewise.ai/threats/cve-2026-82222-stellarwp-givewp-php-object-injection-to-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82222 · Severity: critical · CVSS 10 · Published 2026-08-28

GiveWP is a popular WordPress plugin for managing online donations and fundraising campaigns. A critical vulnerability in versions 4.16.7.1 and below allows unauthenticated attackers to execute arbitrary PHP code on the server through a chain of flaws in data deserialization. This could lead to complete server compromise, data theft, and malware installation with no prior warning or detection required.

Technologies: [StellarWP GiveWP](https://junglewise.ai/threats/technologies/givewp). Vendors: [StellarWP](https://junglewise.ai/threats/vendors/stellarwp).

## Quick answers

**Is CVE-2026-82222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82222 being exploited in the wild.

**How severe is CVE-2026-82222?** Critical severity, with a CVSS score of 10, published 28 August 2026.

**Which products and versions are affected?** StellarWP GiveWP through 4.16.7.1.

**Is there a fix for CVE-2026-82222?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82222 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82222?** Check whether you run StellarWP GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability combines three weaknesses: (1) an unsafe "safe" unserialize helper in src/Helpers/Utils.php that uses allowed_classes=false, which does not neutralize untrusted objects but merely converts them to __PHP_Incomplete_Class placeholders that retain the original class name and properties; (2) a donation processing flow that accepts and deserializes user-controlled data from user meta fields (last_name) without proper sanitization; and (3) gadget chains in GiveWP's codebase that can be exploited upon deserialization. The attack is unauthenticated on default installations (versions 4.16.5.1 and below require only a published donation form and active payment gateway). Exploitation triggers remote code execution via the chained gadget chain when session data is unserialized on subsequent requests.

## Affected products

- StellarWP GiveWP through 4.16.7.1

## Timeline

- 2026-08-28: disclosed
- 2026-08-28: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp?_s_id=cve](https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp?_s_id=cve)

## Related threats

- [GiveWP unauthenticated broken access control](https://junglewise.ai/threats/cve-2026-116853-unauthenticated-broken-access-control-in-givewp-4-19-0-1)
- [StellarWP GiveWP authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-96333-authentication-bypass-by-spoofing-vulnerability-in-liquid-web)
- [GiveWP cross-site scripting in core](https://junglewise.ai/threats/cve-2026-104672-unauthenticated-cross-site-scripting-xss-in-givewp-4-17-0)
- [GiveWP privilege escalation](https://junglewise.ai/threats/cve-2026-104405-unauthenticated-privilege-escalation-in-givewp-4-17-0-versions)
- [StellarWP GiveWP stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104404-improper-neutralization-of-input-during-web-page-generation)