WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
CVSS score
10.0
EPSS probability
%2.3
Risk score
0.2
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: GiveWP <= 4.16.7.1 - Remote Code Execution
⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.
0xCyp1337/CVE-2026-82222-MassExploit
GiveWP <= 4.16.7.1 Unauthenticated PHP Object Injection → RCE
Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
Similar Vulnerabilities
WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-82222"