## https://sploitus.com/exploit?id=AEEBF10A-053B-52EB-93D7-24B0510D9CB9
# CVE-2026-82222
## Unauthenticated PHP object injection to RCE in GiveWP ` & %` in the command; spaces become `${IFS}`.
Pass a form id if discovery misses. Pass `-g` if the script cannot find an enabled gateway.
The donation request often returns HTTP 500 or times out. That is expected. The session write happens first. `system()` output is in the next request (`/?give_action=view_receipt` and similar), not in a file on disk.
`python cve-2026-82222.py -h` for the rest.
## Chain
1. `POST give_action=user_register`. GiveWP creates the account and sets an auth cookie. It does not consult `users_can_register`.
2. Serialized gadget is stored in `last_name` through `/wp-admin/profile.php`.
3. Donation POST omits `give_last`. `process-donation.php` reads the name from usermeta, runs `maybeSafeUnserialize` (`allowed_classes => false`), and writes `__PHP_Incomplete_Class` into `wp_give_sessions`. PHP re-emits the original object bytes on the way in.
4. A request with the same cookie unserializes the session without that guard. `TCPDF::__destruct()` reaches `call_user_func_array('system', [cmd])`. Stdout is in that response.
```
TCPDF.__destruct()
-> Symfony Session.getIterator()
-> Give\TestData ProviderForwarder.__call()
-> call_user_func_array('system', [cmd])
```
`pre_user_last_name` strips NUL, so gadget properties are unmangled. Backslashes are quadrupled to survive `stripslashes_deep` then `removeBackslashes`.
## License
MIT. See `LICENSE`.
### Authorized testing only. Do not run this against hosts you do not own or have permission to test.