GiveWP CVE-2026-82222: RCE Chain from Unauthenticated Registration to PHP Object Injection

查看原文 / View Original 编辑 / Edit

GiveWP CVE-2026-82222: RCE Chain from Unauthenticated Registration to PHP Object Injection

1. Basic Information

Article Title: GiveWP WordPress donation plugin flaw lets hackers execute server commands Publisher: BleepingComputer Publication Date: 2026-08-28 Original Source: BleepingComputer Related Source: Patchstack technical analysis Related Malware, Attack Groups, CVEs, Products: CVE-2026-82222, GiveWP, WordPress, TCPDF Severity: Critical

1. 基本信息

文章标题： GiveWP WordPress 捐赠插件漏洞允许黑客执行服务器命令 发布者： BleepingComputer 发布日期： 2026-08-28 原始来源： BleepingComputer 相关来源： Patchstack 技术分析 相关恶意软件、攻击组织、CVE、产品： CVE-2026-82222, GiveWP, WordPress, TCPDF 严重程度： 严重

2. Executive Summary

In GiveWP versions 4.16.7.1 and earlier, a combination of bypassed configuration settings during account creation, serialized data storage in user profiles, session reconstruction, and TCPDF gadget chains allows unauthenticated attackers to execute OS commands on vulnerable sites.

2. 执行摘要

在 GiveWP 4.16.7.1 及更早版本中，由于账户创建期间配置设置被绕过、用户配置文件中序列化数据存储、会话重构以及 TCPDF 小工具链（gadget chains）的组合，未经身份验证的攻击者可以在易受攻击的站点上执行操作系统命令。

3. Attack Flow

Attack Steps:

  1. The attacker creates an account and obtains a cookie using the custom GiveWP registration feature.
  2. The attacker saves a PHP serialization gadget into the last_name field.
  3. Donation processing converts values into an incomplete object and saves it back to wp_give_sessions.
  4. The original object is reconstructed on the next request.
  5. The gadget chain reaches call_user_func_array() to execute OS commands.

3. 攻击流程

攻击步骤：

  1. 攻击者使用自定义的 GiveWP 注册功能创建账户并获取 Cookie。
  2. 攻击者将 PHP 序列化小工具（gadget）保存到 last_name 字段中。
  3. 捐赠处理过程将数值转换为不完整的对象，并将其保存回 wp_give_sessions。
  4. 在下一次请求时，原始对象被重构。
  5. 小工具链触发 call_user_func_array() 以执行操作系统命令。

4. Attacker Position and Execution Environment

An attacker who can reach the target product and exploit vulnerable functions or improper permission boundaries. Operates with application privileges or elevated privileges after a successful exploit.

4. 攻击者位置与执行环境

攻击者能够访问目标产品并利用易受攻击的功能或不当的权限边界。在成功利用漏洞后，以应用程序权限或提升后的权限进行操作。

5. Visibility for Victims and Administrators

Victims: Appears as normal activity or occurs without user interaction, making it difficult to detect through visual signs alone. Administrators: Sequential requests to give_action=user_register, profile updates, and donation/session APIs. Accounts created despite disabled users_can_register, along with serialized strings in the last_name field. Web server processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.

5. 受害者与管理员的可见性

受害者： 表现为正常活动或在无需用户交互的情况下发生，仅凭视觉迹象难以察觉。 管理员： 对 give_action=user_register、个人资料更新以及捐赠/会话 API 的连续请求。尽管禁用了 users_can_register 但仍有账户被创建，且 last_name 字段中存在序列化字符串。Web 服务器进程（如 php-fpm、apache2 或 httpd）衍生出 Shell 或网络工具。

6. Success and Failure Conditions

Success Conditions: GiveWP version 4.16.7.1 or earlier is running. Custom registration and profile update features are accessible. Public or eligible legacy/non-visual forms and payment gateways exist. Failure Conditions / Risk Mitigation: Update GiveWP to version 4.16.7.2 or later and complete the migration process. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes.

6. 成功与失败条件

成功条件： 运行 GiveWP 4.16.7.1 或更早版本。自定义注册和个人资料更新功能可访问。存在公开或符合条件的旧版/非可视化表单及支付网关。 失败条件 / 风险缓解： 将 GiveWP 更新至 4.16.7.2 或更高版本并完成迁移过程。删除可疑账户、会话和旧版表单。阻止 PHP 序列化模式以及 Web 进程执行操作系统命令。

7. Impact of Successful Exploitation

Arbitrary command execution with web server process privileges. Theft of WordPress settings, donor information, and database credentials. Installation of web shells, website defacement, and lateral movement to the same host.

7. 成功利用的影响

以 Web 服务器进程权限执行任意命令。窃取 WordPress 设置、捐赠者信息和数据库凭据。安装 Web Shell、篡改网站以及在同一主机上进行横向移动。

8. Observable Logs

  • Email: None.
  • Proxy/SWG/DNS: Sequential requests to give_action=user_register, profile updates, and donation/session APIs.
  • Endpoint/EDR: Accounts created despite disabled users_can_register, along with serialized strings in the last_name field.
  • Identity/IdP: Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
  • SaaS/Cloud: Check WAF, load balancers, and audit logs during cloud operations.
  • Network: Check for outbound traffic to unknown destinations after successful exploitation.

8. 可观测日志

  • 电子邮件： 无。
  • 代理/SWG/DNS： 对 give_action=user_register、个人资料更新以及捐赠/会话 API 的连续请求。
  • 终端/EDR： 尽管禁用了 users_can_register 但仍有账户被创建，且 last_name 字段中存在序列化字符串。
  • 身份/IdP： Web 服务器进程（如 php-fpm、apache2 或 httpd）衍生出 Shell 或网络工具。
  • SaaS/云： 在云操作期间检查 WAF、负载均衡器和审计日志。
  • 网络： 检查成功利用漏洞后是否存在指向未知目的地的出站流量。

9. Attack Success Assessment

  • Attack Attempt Observed (Success Unconfirmed): Contact with the target is confirmed, but unauthorized operations or code execution are unconfirmed.
  • User Interaction Confirmed: This issue does not require user interaction or can be completed via API operations alone.
  • Initial Execution Confirmed: Unauthorized responses, processing, or suspicious child processes are confirmed.
  • Information Theft or Session Compromise Confirmed: Unauthorized data retrieval, credential access, or transmission is confirmed.
  • Post-Exploitation Confirmed: Additional payloads, persistence, defacement, deletion, or lateral movement is confirmed.

9. 攻击成功评估

  • 观察到攻击尝试（成功未确认）： 已确认与目标接触，但未经授权的操作或代码执行尚未确认。
  • 已确认无需用户交互： 此问题不需要用户交互，或仅通过 API 操作即可完成。
  • 已确认初始执行： 已确认存在未经授权的响应、处理或可疑的子进程。
  • 已确认信息窃取或会话受损： 已确认存在未经授权的数据检索、凭据访问或传输。
  • 已确认利用后行为： 已确认存在额外的载荷、持久化、篡改、删除或横向移动。

10. Investigation Playbook

  • Trigger: Detection of GiveWP, WordPress, or TCPDF vulnerability exploitation or abnormal behavior.
  • Initial Verification: Check version, public exposure scope, patch status, initial anomaly timestamp, and source IP. Preserve HTTP, application, and audit logs.
  • Endpoint: Accounts created despite disabled users_can_register, along with serialized strings in the last_name field.
  • Authentication/Cloud: Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
  • Subsequent Operations: Investigate additional files, outbound traffic, credential access, and impact on other assets.
  • Containment: Update GiveWP to version 4.16.7.2 or later and complete the migration. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes. Isolate targets and revoke related credentials and sessions if a compromise is confirmed.
  • Classification: Distinguish between contact, prerequisite fulfillment, initial success, information compromise, and post-exploitation.

10. 调查手册

  • 触发条件： 检测到 GiveWP、WordPress 或 TCPDF 漏洞利用或异常行为。
  • 初步验证： 检查版本、公开暴露范围、补丁状态、初始异常时间戳和源 IP。保留 HTTP、应用程序和审计日志。
  • 终端： 尽管禁用了 users_can_register 但仍有账户被创建，且 last_name 字段中存在序列化字符串。
  • 身份/云： Web 服务器进程（如 php-fpm、apache2 或 httpd）衍生出 Shell 或网络工具。
  • 后续操作： 调查额外文件、出站流量、凭据访问以及对其他资产的影响。
  • 遏制： 将 GiveWP 更新至 4.16.7.2 或更高版本并完成迁移。删除可疑账户、会话和旧版表单。阻止 PHP 序列化模式以及 Web 进程执行操作系统命令。如果确认受损，隔离目标并撤销相关凭据和会话。
  • 分类： 区分接触、前提满足、初始成功、信息泄露和利用后行为。

11. Defense and Detection Ideas

  • Single Event: Sequential requests to give_action=user_register, profile updates, and donation/session APIs.
  • Timeline Correlation: External request or operation -> Vulnerable function -> Arbitrary command execution with web server process privileges -> Correlate subsequent behavior.
  • Hunting: Sequential requests to give_action=user_register, profile updates, and donation/session APIs. Accounts created despite disabled users_can_register, along with serialized strings in the last_name field. Web processes (such as php-fpm, apache2, or httpd) spawning shells or network tools.
  • Log Gaps: Without correlating timestamps across HTTP, applications, processes, identity, and network logs, it is impossible to determine the success stage.
  • Priority Countermeasures: Update GiveWP to version 4.16.7.2 or later and complete the migration. Remove suspicious accounts, sessions, and legacy forms. Block PHP serialization patterns and OS command execution from web processes.

11. 防御与检测思路

  • 单一事件： 对 give_action=user_register、个人资料更新以及捐赠/会话 API 的连续请求。
  • 时间线关联： 外部请求或操作 -> 易受攻击的功能 -> 以 Web 服务器进程权限执行任意命令 -> 关联后续行为。
  • 威胁狩猎： 对 give_action=user_register、个人资料更新以及捐赠/会话 API 的连续请求。尽管禁用了 users_can_register 但仍有账户被创建，且 last_name 字段中存在序列化字符串。Web 服务器进程（如 php-fpm、apache2 或 httpd）衍生出 Shell 或网络工具。
  • 日志缺口： 如果无法关联 HTTP、应用程序、进程、身份和网络日志中的时间戳，则无法确定攻击成功阶段。
  • 优先对策： 将 GiveWP 更新至 4.16.7.2 或更高版本并完成迁移。删除可疑账户、会话和旧版表单。阻止 PHP 序列化模式以及 Web 进程执行操作系统命令。

12. Facts / Inference / Hypothesis

Facts: give_action=user_register bypassed the WordPress users_can_register setting, allowing attackers to issue accounts and cookies. Attackers…

12. 事实 / 推论 / 假设

事实： give_action=user_register 绕过了 WordPress 的 users_can_register 设置，允许攻击者签发账户和 Cookie。攻击者……

← 返回新闻列表 / Back to news list