What Gridinsoft observed on centerforonlineevangelism.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903214448-ef2725f3
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
This follow-up corrects the earlier same-day conclusion. Fresh homepage and donation responses plus the plugin readme show GiveWP 4.16.7.2, patched for CVE-2026-82222; 4.16.5.1 remains only in cached presentation. Current public checks do not reproduce phishing, malware delivery or the historical /wp-content/ redirect. Remove the unsupported warning for the reviewed apex and www site. Purging old page caches is recommended, but stale metadata is not proof of a vulnerable server.
Analyst findings
Review 5 documented observations View evidence
The earlier same-day review assembled 379 public entry and sitemap targets without reproducing phishing, an unrelated credential receiver, malware delivery or an off-domain final URL. Its evidence was retained. The present follow-up fetched the homepage and donation page again; both stayed on the expected site with HTTP 200.
-
HTTP status
200 - Public artifact URL https://www.centerforonlineevangelism.org/
- Public artifact URL https://www.centerforonlineevangelism.org/donate/
Cached homepage and donation responses still showed GiveWP 4.16.5.1 with X-Nitro-Cache: HIT. Fresh requests to both pages returned X-Nitro-Cache: MISS and GiveWP 4.16.7.2 in generator metadata and runtime configuration. The public plugin readme independently reported Stable tag: 4.16.7.2. The old version is cached presentation, not sufficient evidence that the server still runs the affected version.
- Page element Give v4.16.7.2
- Page element Stable tag: 4.16.7.2
- Public artifact URL https://www.centerforonlineevangelism.org/wp-content/plugins/give/readme.txt
The primary CVE record and Patchstack advisory identify GiveWP through 4.16.7.1 as affected and 4.16.7.2 as patched for CVE-2026-82222. Thus current public version evidence supports remediation of this specific issue. The official plugin directory lists 4.16.8 as the latest release; patched for this CVE does not mean latest release.
- Public artifact URL https://cveawg.mitre.org/api/cve/CVE-2026-82222
- Public artifact URL https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability
- Public artifact URL https://wordpress.org/plugins/give/
Two urlscan captures dated 2025-07-15 preserve an off-domain redirect from /wp-content/ to a fake connection-verification page. These are historical URL behavior records, not a current malware sample. Later records did not reproduce it. The exact path again returned HTTP 200, zero bytes and no redirect in this follow-up.
-
HTTP status
200 - Public artifact URL https://urlscan.io/result/01980f75-8581-75e9-9270-75be751f0ba7/
- Public artifact URL https://urlscan.io/result/01980f83-622d-73cf-a797-e934f4cf08fb/
-
Final URL
https://centerforonlineevangelism.org/wp-content/
Fresh searches of urlscan returned 15 parent-domain records and five www records, with no newer harmful behavior than the historical redirect. OTX returned two parent-domain pulses citing the same malware-filter list and none for www. Search indexes exposed no current exact harmful sample. Retained archive review covered 3,101 objects and representative ministry snapshots; Wayback again had no successful /wp-content/ snapshot. Earlier URLhaus/ThreatFox authorization limits and inaccessible Hybrid Analysis/Triage results remain unknown, not clean.
- Public artifact URL https://urlscan.io/domain/centerforonlineevangelism.org
- Public artifact URL https://urlscan.io/domain/www.centerforonlineevangelism.org
- Public artifact URL https://otx.alienvault.com/indicator/domain/centerforonlineevangelism.org
- Public artifact URL https://web.archive.org/
Scope and limitations
- The retained 379-target crawl included rate-limited and missing responses; these were not treated as clean. Private files, logs, administrative access and all unlinked paths were outside scope.
- No exploit, account creation or donation transaction was attempted. Public version evidence supports the named patch but is not a full server-integrity or Wordfence audit.
- Public search, scanner, sandbox and archive indexes are incomplete. Unavailable and authorization-only results remain unknown; no absence-of-results claim certifies all content.
- The result covers the reviewed apex and www public website at this time, not separately hosted subdomains, private sessions or future changes.
Help protect others by sharing this page on social media! The more people who know about centerforonlineevangelism.org, the fewer chances they have to deceive someone else. Help others evaluate centerforonlineevangelism.org by sharing this page on social media!