Affected Systems
GiveWP WordPress donation plugin versions 4.16.6 through 4.16.7.1. Over 100,000 active installations. Exploitation requires legacy donation forms without 'formBuilderSettings' (common in upgraded sites or when using option-based form editor).
Exploitation Status
Publicly disclosed with technical details. No active exploitation confirmed yet, but proof-of-concept methodology published by Patchstack. Exploitation complexity is moderate (requires chaining three vulnerabilities). Immediate weaponization expected given detailed disclosure.
Business Impact
Unauthenticated attackers can achieve full remote code execution on WordPress servers running vulnerable GiveWP versions. The plugin's exposed registration action bypasses WordPress registration controls, allowing attackers to create accounts even when registration is disabled. Successful exploitation grants complete server compromise, enabling data theft, malware installation, lateral movement, and site defacement. GiveWP was previously targeted in 2025 to breach Pi-hole and expose 30,000 donor records. Organizations using this plugin for donation processing face immediate risk of financial data exposure and reputational damage.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update GiveWP to version 4.16.7.2 or later, which blocks serialized data during donation processing and removes existing malicious payloads from databases
- Audit WordPress user accounts created since July 28, 2026 for suspicious registrations via the give_action=user_register endpoint, especially on sites with registration disabled
- Review wp_give_sessions database table for anomalous serialized objects and check web server logs for POST requests to donation endpoints with unusual payloads
- Inspect legacy donation forms for presence of 'formBuilderSettings' and migrate or update forms lacking this protection
- Monitor server processes for unexpected command execution and review file integrity on WordPress installations running GiveWP versions 4.16.6-4.16.7.1