CVE-2026-82222
CriticalPublished
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
- Published
- Aug 28, 2026
- Updated
- Aug 28, 2026
- Assigning CNA
- Patchstack
- Evidence observed
- Aug 30, 2026
Primary CVSS
10.0/ 10Critical
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
http/cves/2026/CVE-2026-82222.yaml
Exploit tool for CVE-2026-82222, an unauthenticated RCE in GiveWP WordPress plugin. Supports single-target and batch exploitation with multi-threading, proxy support, and JSON/TXT export.
Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
GiveWP <= 4.16.7.1 Unauthenticated PHP Object Injection → RCE
Proof-of-concept exploit for CVE-2026-82222, an unauthenticated PHP object injection leading to remote code execution in GiveWP WordPress plugin versions up to 4.16.7.1.
Exploit framework for CVE-2026-82222, an unauthenticated RCE in GiveWP WordPress plugin. Supports mass scanning, auto-detection, multi-threading, JSON/TXT output, and interactive shell for authorized testing.
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.