---
id: "CVE-2026-82568"
page: "https://infrastack.ai/live/CVE-2026-82568"
kind: "vulnerability"
aliases: ["CVE-2026-82568"]
title: "Give Peer-to-Peer WordPress plugin: time-based SQL injection via sort parameter"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["give", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-above-2.9.3", "plugin-not-installed"]
published_at: "2026-11-15T10:16:54+00:00"
first_seen_at: "2026-11-15T10:34:26+00:00"
updated_at: "2026-11-15T10:35:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82568", "first_seen_at": "2026-11-15T10:34:26+00:00"}]
exploit_sources: []
---

# Give Peer-to-Peer WordPress plugin: time-based SQL injection via sort parameter

Link for people: https://infrastack.ai/live/CVE-2026-82568 (this .md is for agents)

The Give Peer-to-Peer WordPress plugin lets unauthenticated visitors inject SQL through the 'sort' parameter, in all versions up to and including 2.9.3. An attacker can read sensitive data from the site's database, and the sources say it can be chained with CVE-2026-82663 to reach remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Give Peer-to-Peer plugin in the WordPress admin under Plugins, or in the plugin's header in `wp-content/plugins/`
- Confirm whether at least one Peer-to-Peer campaign exists, since the sources say exploitation requires one

## Fix

- Move the Give Peer-to-Peer plugin to a version newer than `2.9.3`; the sources do not name the exact fixed version

## Timeline

- 2026-11-15T10:34:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82568

## From the sources

The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_