Critical GiveWP Flaw Lets Attackers Take Over WordPress Servers
GiveWP versions through 4.16.7.1 contain an unauthenticated PHP object injection vulnerability that can be chained to execute commands on the server. The issue is fixed in version 4.16.7.2.
CERT24