GiveWP WordPress Donation Plugin CVE-2026-68811 Allows Unauthenticated Server-Side Code Execution — 100,000 Sites Affected

Summary

A critical PHP object injection vulnerability in GiveWP, a WordPress donation and fundraising plugin active on more than 100,000 websites, allows unauthenticated remote attackers to execute arbitrary code on vulnerable web servers. CVE-2026-68811 carries a CVSS score of 10.0 and was discovered by Patchstack researcher villu164. The vulnerability exists because the plugin deserializes user-supplied input passed through the give_title parameter without first validating or sanitizing it. PHP object injection vulnerabilities occur when an application deserializes attacker-controlled data, allowing the attacker to instantiate arbitrary PHP objects and chain them to trigger unintended code execution through a technique known as POP chain exploitation. An unauthenticated attacker can send a specially crafted POST request to a vulnerable GiveWP installation and achieve server-side code execution with the privileges of the web server process, which in most WordPress deployments includes the ability to read and write files across the site, access the database, and install additional malicious code. GiveWP patched CVE-2026-68811 in version 3.22.5. Patchstack urges all GiveWP administrators to update immediately and to audit their installations for signs of unauthorized access.

Timeline

Domain Intelligence

Context

givewp.com scores 71.35 — above the trust threshold, consistent with an established WordPress plugin developer. GiveWP is used by nonprofit organizations, churches, educational institutions, and charitable campaigns to accept donations through WordPress. A CVSS 10.0 unauthenticated code execution vulnerability in a donation plugin carries a specific operational risk beyond the standard web server compromise scenario: GiveWP installations typically store donor payment information, personal details, and transaction records. An attacker who achieves code execution on a GiveWP-enabled site has access not only to the web server but to the payment and personal data of everyone who has donated through that installation. Nonprofit organizations and churches are not typical targets for sophisticated threat actors, but they are frequently targeted by opportunistic attackers who scan for known WordPress plugin vulnerabilities using automated tools. The combination of a CVSS 10.0 score and more than 100,000 affected sites makes CVE-2026-68811 an attractive automated scanning target.