GiveWP

Patchstack disclosed CVSS 10.0 unauthenticated PHP Object Injection to RCE in GiveWP. Sites with affected donation flows should update to 4.16.7.2 immediately and review sessions, users, and recent PHP file changes.

Patchstack published a critical GiveWP advisory on August 28, 2026 describing unauthenticated PHP Object Injection that can be chained to remote code execution. GiveWP is a donation and fundraising plugin with 100,000+ active installations, so this is a high-priority patch for nonprofit, fundraising, and WooCommerce-adjacent WordPress sites.

The vulnerability affects GiveWP versions up to and including 4.16.7.1 and is fixed in 4.16.7.2. Patchstack rates the issue CVSS 10.0 because the chain can allow a visitor with no prior account to create the needed session state and reach code execution on vulnerable configurations.

Table of Contents

Vulnerability Summary

Plugin: GiveWP
Slug: give
Severity: CVSS 10.0 critical
Attack class: PHP Object Injection leading to remote code execution
Required access: none
Affected versions: GiveWP up to and including 4.16.7.1
Fixed version: 4.16.7.2
Common exposure: at least one published donation form and an active payment gateway; older default installs are especially exposed

Technical Cause

The root issue is not a single unsafe request parameter. Patchstack describes a chain involving GiveWP’s unserialize helper, donation session storage, and a gadget chain in code shipped with the plugin. The helper uses unserialize() with allowed_classes => false, which turns objects into __PHP_Incomplete_Class placeholders but can preserve the original serialized object bytes when data is later serialized again.

Those bytes can be written into GiveWP session data and later read by code paths that unserialize without the same guard. GiveWP also shipped classes that can form a practical gadget chain, converting the object injection into command execution. The Patchstack article includes deeper root-cause detail; this WPDeeply note intentionally avoids weaponized payloads or replay steps.

Version-Specific Exposure

GiveWP 4.16.5.1 and older: Patchstack says a default installation can be exploitable when a published donation form and active gateway exist.
GiveWP 4.16.6 through 4.16.7.1: reachability is narrower, but the vulnerable chain can remain reachable on upgraded, restored, imported, or legacy form-editor sites.
GiveWP 4.16.7.2: patched by breaking the chain in multiple places, including safer handling of incomplete classes, donation write paths, read sinks, gadget behavior, and stored meta.

Immediate Remediation

Update GiveWP to 4.16.7.2 or newer immediately.
Temporarily disable GiveWP donation forms if the update cannot be deployed now.
Review unexpected users, donor profile changes, and donation session activity.
Inspect recently modified PHP files in wp-content, uploads, cache, and temporary directories.
Rotate administrator credentials and invalidate sessions if suspicious file-write or account activity is found.

WP-CLI Verification

wp plugin get give --fields=name,version,status
wp plugin update give
wp plugin get give --field=version

Check for recently modified PHP files. Treat output as a review queue rather than an automatic deletion list.

find wp-content -type f -name '*.php' -mtime -7 -print
wp core verify-checksums
wp plugin verify-checksums --all

Database Review

Run read-only checks for suspicious serialized object markers in GiveWP session storage and recent account changes. These queries do not prove exploitation by themselves, but they highlight data that deserves manual review.

wp db query "SELECT id, session_id, updated FROM {prefix}give_sessions WHERE session_value LIKE '%O:%' OR session_value LIKE '%__PHP_Incomplete_Class%' ORDER BY updated DESC LIMIT 50;"
wp db query "SELECT ID,user_login,user_email,user_registered FROM {prefix}users WHERE user_registered >= DATE_SUB(NOW(), INTERVAL 14 DAY);"

Temporary Mitigation

The permanent fix is GiveWP 4.16.7.2 or newer. If patching is delayed, disable public donation processing and remove public registration paths related to GiveWP until the update is deployed and tested. On high-risk sites, temporarily deactivate the plugin.

# Emergency containment only; update the plugin as the permanent fix.
wp plugin deactivate give