---
id: 7268
title: "dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC"
cve: CVE-2026-82222
cvss: 9.8
vendor: "GiveWP"
product: "GiveWP Donation Plugin and Fundraising Platform for WordPress"
affected_versions: "4.16.5.1 and earlier; fixed in 4.16.7.2"
source_domain: github.com
source_url: "https://github.com/dinosn/givewp-cve-2026-82222-rce-lab"
published_at: "2026-08-30T05:15:27Z"
tags: ["rce", "php", "wordpress", "vulnerability", "cve", "poc", "security-research", "docker", "givewp", "cve-2026-82222"]
phying_url: "https://phying.com/item/7268"
lang: en
---

# dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC

## Summary

A Docker lab reproducing CVE-2026-82222 in GiveWP 4.16.5.1: an unauthenticated PHP object-injection chain reaching marker command execution, with a constrained PoC; fixed in 4.16.7.2.

## Why it matters

This research and reproducible lab validates a critical PHP object-injection POP chain in GiveWP, enabling security teams to test exposure, assess detections, and verify the 4.16.7.2 patch.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-82222
- **CVSS:** 9.8
- **Vendor:** GiveWP
- **Product:** GiveWP Donation Plugin and Fundraising Platform for WordPress
- **Affected versions:** 4.16.5.1 and earlier; fixed in 4.16.7.2
- **Published:** 2026-08-30T05:15:27Z
- **Original:** https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
- **Phying News:** https://phying.com/item/7268