0xcyp1337/cve-2026-82222-massexploitExploit tool for CVE-2026-82222, an unauthenticated RCE in GiveWP WordPress plugin. Supports single-target and batch exploitation with multi-threading, proxy support, and JSON/TXT export.
-red.svg){kind=icon}
Critical Unauthenticated Remote Code Execution (CVSS 9.8) — GiveWP ≤ 4.16.7.1
This tool exploits CVE-2026-82222, a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands on the server via a PHP Object Injection (POP chain) deserialization attack.
| Property | Value |
|---|
| CVE ID | CVE-2026-82222 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-502 — Deserialization of Untrusted Data |
| Affected Product | GiveWP — Donation Plugin & Fundraising Platform ≤ 4.16.7.1 |
| Patched Version | 4.16.8 |
| Auth Required | TIDAK (unauthenticated) |
| Status | Active Exploitation |
The vulnerability exists in the TCPDF class deserialization chain. By sending a crafted payload through the donation form submission process, an attacker can:
last_name field in the user profilegive_process_donation)The exploit uses Base64 encoding to bypass WAF/filters and ensure reliable execution.
| Step | Action | Description |
|---|---|---|
| 1 | Fingerprint | Detect GiveWP plugin presence |
| 2 | Register | Create a new WordPress user account |
| 3 | Store Payload | Inject POP gadget chain into user profile |
| 4 | Discover Form | Find a valid donation form ID |
| 5 | Find Gateway | Test payment gateways for working endpoint |
| 6 | Execute | Trigger deserialization and run command |
-u)-f targets.txt)-t 20) — fast parallel processingVULNERABLE and EXPLOITED summaries--proxy)--timeout)-v) for debuggingrequests# Clone the repository
git clone https://github.com/0xCyp1337/CVE-2026-82222-MassExploit.git
cd CVE-2026-82222
python3 CVE-2026-82222.py -h
# Install dependencies
pip install requests