Description
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection.
This issue affects GiveWP: from n/a through 4.16.7.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Liquid Web / StellarWP | GiveWP | ≤ 4.16.7.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
dinosn/givewp-cve-2026-82222-rce-lab ★ 16 · Aug 30, 2026
Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
-
UdinChan/cve-2026-82222-poc ★ 1 · Aug 30, 2026
Public PoC for CVE-2026-82222
-
GhostlyrootB2H/CVE-2026-82222 ★ 0 · Sep 8, 2026
⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interacti…
-
0xCyp1337/CVE-2026-82222-MassExploit ★ 0 · Sep 6, 2026
-
R0x19/CVE-2026-82222 ★ 0 · Aug 31, 2026
GiveWP <= 4.16.7.1 Unauthenticated PHP Object Injection → RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- GiveWP <= 4.16.7.1 - Remote Code Execution http/cves/2026/CVE-2026-82222.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.