Preliminary research

CVE-2026-82222: GiveWP object-injection RCE validation lab

dinosn · GitHub

AI-collected research leads through 1 October 2026, including a bounded September review of selected social and community sources. Unranked, incomplete, not community-vetted, and subject to change.

A marker-only lab reconstructs GiveWP's staged PHP object-injection chain: restricted unserialization preserves class data, session handling later revives it, and implicit iteration bridges TCPDF through Symfony and a GiveWP callable to command execution. It verifies pristine vulnerable and patched releases with hashes, positive evidence and independent negative controls.

Record

Researcher

dinosn

Published by

GitHub

Format

Repository

Topic

Injection

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Remote Code Execution (RCE) in WordPress GiveWP Plugin

Tags

• deserialization
• gadget-chain
• rce
• wordpress
• php
• tooling
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of dinosn, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 1 October 2026.