/Vulnerability Library

GiveWP <= 4.16.7.1 - Remote Code Execution

CVE-2026-82222
Verified

Description

GiveWP <= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Affected Product

givewp

Published Date

September 2, 2026

Template Author

0x_akoko, pdteam

CVE-2026-82222.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-82222
CWE ID:
cwe-502

References

https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/https://www.cve.org/CVERecord?id=CVE-2026-82222

Remediation Steps

Update to the latest version beyond 4.16.7.1.