Blog GiveWP 4.16.7.2 patches a critical unauthenticated RCE
GiveWP 4.16.7.2 patches a critical unauthenticated RCE
GiveWP shipped 4.16.7.2 for an unauthenticated PHP object-injection RCE with a CVSS of 10. The Events Calendar patched a similar bug in 6.17.3.1. A WPMU DEV Dashboard auth bypass has no fix. An old Pods privilege escalation resurfaced in a news write-up.
Two of the four critical WordPress plugin advisories below share a root cause: PHP object injection in a plugin that reads serialized data from unauthenticated visitors. give shipped 4.16.7.2 as the fix. the-events-calendar shipped 6.17.3.1. Both plugins run on hundreds of thousands of sites. Neither bug needed a login.
The other two are different in shape and identical in threat model. An authentication bypass in the WPMU DEV Dashboard plugin hands an attacker an administrator session. A privilege-escalation flaw in pods, patched two years ago in the 2.x line, only received a public write-up on 29 August. Three of the four bugs are reachable without a login. The one that is not gives out an administrator session anyway.
give 4.16.7.2
CVE-2026-82222 is a deserialization bug in GiveWP. An unauthenticated visitor can run PHP code on the server. The CVE description names PHP object injection through the plugin’s serialized-data handling. It gives no further mechanism. The 4.16.7.2 changelog calls the fix “additional hardening for serialized data handling in the donation flow”, which points at the same place.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network reach, no privileges, no user click, and the scope changes. A donation form on a public page is the reachable surface.
- Affected: versions 4.16.7.1 and earlier
- Fixed in: 4.16.7.2
- CVE: CVE-2026-82222, CVSS 10
- CWE-502, deserialization of untrusted data
- Installed on ~100,000 sites
- No login required
- Update to 4.16.7.2. Then check the site for unfamiliar admin users and for PHP files under
wp-content/uploads/.
the-events-calendar 6.17.3.1
A second PHP object injection flaw. This time in The Events Calendar. No CVE has been published for it yet. The mechanism is not public. The 6.17.3.1 release is what the wordpress.org directory serves, one number above the affected 6.17.2.
- Affected: versions 6.17.2 and earlier
- Fixed in: 6.17.3.1
- Class: PHP object injection (deserialization)
- Installed on ~600,000 sites
- Update to 6.17.3.1
wpmu-dev-dashboard up to 5.0.1, unpatched
CVE-2026-76581 is an authentication bypass in the WPMU DEV Dashboard plugin. The unauthenticated wdpsso_step1 AJAX action signs a concatenation of four values: a token, a state, a redirect and a domain. The wdpsso_step2 action verifies a concatenation that leaves the domain field out. An attacker asks step 1 for a valid HMAC. The attacker then moves the domain value into the redirect field and replays the message to step 2. Step 2 accepts the signature and hands back an authenticated administrator session.
The attack needs one setting on the site: Hub SSO enabled in the plugin, mapped to an administrator account. Sites that use the plugin only for updates and never turn on Hub SSO are not exposed to this path.
- Affected: versions 5.0.1 and earlier
- Fixed in: no release is named in the advisory
- CVE: CVE-2026-76581, CVSS 9.8
- CWE-347, improper verification of a cryptographic signature
- Precondition: Hub SSO enabled and mapped to an administrator
- No login required
- Turn off Hub SSO until a fix ships. Or unmap the SSO from every administrator account.
WPMU DEV Dashboard is distributed through WPMU DEV, not the wordpress.org directory, so no public install count is available.
pods 2.8.23.3
CVE-2026-19598 is an unauthenticated privilege escalation in Pods. The pods_admin AJAX router sends every access check through pods_error(). That includes the method allowlist, the nonce check, the login check and the capability gate. Under the JSON meta-box-loader compatibility path, pods_error() writes the failure to the PHP error log and returns false instead of stopping the request. Every guard turns into a log line. An unauthenticated attacker reaches administrator methods, and can overwrite any user password, including the site owner’s.
The advisory range is versions before 2.8.23.3. Version 2.8.23.3 is where pods_error() in includes/general.php changed. Anyone running Pods on the 3.x line, which the directory has served for a long time, is not exposed to this CVE. The current directory release is 3.3.9.1. The bug matters now because a news write-up brought it back into circulation, and sites still stuck on old 2.x releases exist.
- Affected: versions before 2.8.23.3
- Fixed in: 2.8.23.3
- CVE: CVE-2026-19598, CVSS 9.8
- CWE-863, incorrect authorization
- Installed on ~100,000 sites
- No login required
- If the site runs Pods below 2.8.23.3, update. The current directory release is 3.3.9.1.
Three of these four bugs give an attacker administrator access without a login. That is the shape a site scanner has to watch for, because nothing in the site’s own audit log will record the attacker’s arrival. No failed login. No password reset request. No admin account creation that a human recognises. A file scan of wp-content/ and a check of the user table are the two answers a site owner has today.
Tags: #wordpress , #plugin , #cve , #exploit