WordPress Updates and Vulnerabilities This Week: GiveWP, Pods and WooCommerce Under Attack

Four CVEs affecting widely-deployed WordPress plugins, all released in recent weeks, all with publicly available PoC or documented active exploitation. Anyone managing shared hosting or VPS with WordPress installations for clients has good reason to check today, 12 October 2026, which versions are running on their servers.

GiveWP: CVE-2026-82222, Unauthenticated RCE

The GiveWP donations plugin, installed on over 100,000 sites, is vulnerable up to version 4.16.7.1. CVE-2026-82222 is a critical PHP Object Injection vulnerability (CWE-502) in the GiveWP plugin for WordPress that allows remote unauthenticated attackers to inject malicious PHP objects via unsafe deserialisation, exploitable to achieve remote code execution. Patchstack assigns a CVSS v3.1 score of 10.0. Patchstack credits the discovery to researcher Udin Chan, who reported the issue on 28 July, whilst the fix was released on 27 August. The patched version is 4.16.7.2, which blocks serialised data during donation processing, restricts object creation at deserialisation points and proactively removes already-present serialised object payloads from affected databases.

Verification from command line:

wp plugin list --name=give --field=version
wp plugin update give

Pods: CVE-2026-19598, Unauthenticated Privilege Escalation to Administrator

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to privilege escalation via authorisation bypass in all versions up to and including 3.3.9. CVSS score is 9.8. The vulnerability resides in the pods_admin AJAX router, which via pods_error() bypasses all access checks, capability gates, nonce verification and login checks when using the JSON meta-box-loader path, allowing an attacker to call administrative methods and even overwrite user passwords, effectively gaining Administrator privileges. Wordfence disclosed the issue, crediting Nhien Pham through the Wordfence Bug Bounty programme. The fix was released on 14 August in version 3.3.9.1, with backports to versions 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3.

wp plugin list --name=pods --field=version
wp plugin update pods

WooCommerce Wholesale Lead Capture: CVE-2026-27540, Arbitrary File Upload

According to the Patchstack database for this plugin, an Arbitrary File Upload vulnerability is registered in versions up to 2.0.3.1, patched on 20 February 2026 (a Privilege Escalation affecting the same version range was also corrected in the same update). For complete technical details on how the exploit works, refer to the Patchstack entry for the plugin, not yet available in extended form at the time this article went to press.

wp plugin list --name=woocommerce-wholesale-lead-capture --field=version
wp plugin update woocommerce-wholesale-lead-capture

Ajax Search Lite: CVE-2026-28139, Unauthenticated Object Injection via REST

The Patchstack database for Ajax Search Lite plugin (70,000 installations) lists an Unauthenticated PHP Object Injection vulnerability via Search Statistics REST Endpoint in versions prior to 4.14.5, patched on 20 August 2026. The current version available on wordpress.org is 4.14.5.

wp plugin list --name=ajax-search-lite --field=version
wp plugin update ajax-search-lite

Summary

CVE	Plugin	Vulnerable version	Patched version
CVE-2026-82222	GiveWP	≤ 4.16.7.1	4.16.7.2
CVE-2026-19598	Pods	≤ 3.3.9	3.3.9.1
CVE-2026-27540	WooCommerce Wholesale Lead Capture	≤ 2.0.3.1	later (patch 20/02/2026)
CVE-2026-28139	Ajax Search Lite	< 4.14.5	4.14.5

To update all plugins in an installation at once: wp plugin update --all. On multi-tenant hosting, it's worth running a script that executes wp plugin list --fields=name,version,update on each installation and flags any below the threshold.