Critical GiveWP flaw allows unauthenticated attackers to execute server commands

·1 views

A critical vulnerability, tracked as CVE-2026-82222, has been discovered in GiveWP, a popular WordPress donation plugin, affecting versions 4.16.7.1 and earlier. The flaw allows unauthenticated attackers to chain multiple weaknesses — including a registration bypass, PHP object injection via the last_name field, and a TCPDF gadget chain — to achieve remote code execution on vulnerable servers. Exploitation requires no user interaction and can be carried out entirely through API requests, making it particularly dangerous. Successful attacks could lead to theft of donor data and database credentials, installation of web shells, and lateral movement within the hosting environment. Site administrators are urged to update GiveWP to version 4.16.7.2 or later and audit their installations for suspicious accounts, sessions, and legacy forms.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Power Users Turn on AI Coding Tools Over Billing, UI Chaos and Hidden Nudges

Developers on Hacker News spent the past week airing specific, technical grievances about AI coding assistants — not about AI safety, but about cost, interface instability, and manipulative design. Cursor, a popular AI code editor, drew sharp criticism from users who reported unsolicited feature pop-ups, silent model switches to Grok, and a constantly shifting UI described as 'enshittification' — a term for products optimised for company metrics over user needs. A separate Cursor user noted they were paying for a subscription they no longer used because the tool offered them nothing of value, reflecting a quiet but damaging pattern of passive churn. GitHub Copilot also came under scrutiny after a developer discovered that requests labelled 'agent' rather than 'user' in network traffic did not count against premium usage quotas, raising questions about billing transparency. Taken together, the complaints point to growing frustration among heavy AI tool users with opaque pricing, eroding trust, and products that increasingly feel designed to serve vendors rather than developers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UwView Pro vs Klogg: Benchmark Shows 50,000x Faster Reopen on Large Log Files

A benchmark published on DEV Community compared klogg 24.11.0 and UwView Pro when handling a 47.73GB log file with over 892 million lines on an Apple M4 MacBook Air. While klogg was slightly faster on the first open, it rebuilds its index from scratch every time a file is reopened, taking up to nine minutes on a USB hard drive. UwView Pro builds a compressed sidecar cache on first open, allowing subsequent reopens in as little as 0.01 to 0.07 seconds — roughly 1,250 to 50,000 times faster. The compressed cache also reduces storage from 48GB to 5.3GB, meaning the original file can be deleted while retaining full browse and search capability. Search speeds were also significantly faster in UwView Pro, with a literal search on a USB HDD dropping from roughly ten minutes to 75 seconds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Prevent Duplicate Notifications in Node.js Bulk Email and SMS Systems

Developers building bulk notification systems in Node.js face a core challenge: ensuring messages are sent exactly once across email, SMS, queues, and scheduled pollers. The recommended approach involves writing each notification intent to a durable outbox table within the same database transaction as the triggering business event, keeping the two concerns cleanly separated. A queue worker then claims small batches of outbox rows using leases, allowing other workers to recover tasks if a process dies mid-delivery. Every delivery attempt must be idempotent, with a stable deduplication key per channel, since true exactly-once delivery cannot be guaranteed across distributed systems. Email and SMS workloads should maintain separate concurrency budgets to prevent one channel's retries or slowdowns from starving the other.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Client Islands Keep WebSockets Efficient in React Server Components

Developers using React Server Components (RSC) are advised against wrapping entire pages in 'use client' to handle real-time WebSocket features, as this inflates client bundles and worsens Interaction to Next Paint (INP) scores. A recommended alternative involves keeping pages as Server Components and isolating WebSocket logic inside small client islands — typically just 5–20 lines of code. These islands push incoming data into a client-side cache such as TanStack Query or SWR, limiting re-renders to only the components that consume the updated data. This approach preserves RSC benefits like server-rendered HTML, streaming, and minimal JavaScript delivery to the browser. Trade-offs include the need for a well-thought-out cache invalidation strategy and a different debugging model where state is split between server renders and client caches.

0 comments Read more at DEV Community