#patchstack

2 articles

The donation plugin lets strangers register on sites where registration is off — then run commands

2026-08-31Security

CVE-2026-82222 in GiveWP chains three weaknesses into unauthenticated command execution on the hosting server: an unsafe PHP unserialize helper, a donation flow that stores attacker-controlled objects, and a gadget chain in bundled libraries. Over 100,000 sites run it, and most of them belong to organisations with no security budget.

The plugin used the identity provider's public key as a shared secret — and only the free edition got told

2026-08-26Security

Two flaws in miniOrange's SAML SSO plugin for WordPress chain into a full authentication bypass, and attacks are already underway. One lets an attacker sign assertions with a key everybody has. The other treats an OpenSSL verification error as a pass. Fixes exist for all seven editions; the vendor's advisory covered one.