Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

CVE-2026-18431 is a critical (CVSS 9.8) arbitrary file write vulnerability in the Avada WordPress theme (all versions through 7.16) that is exploitable when the bundled Fusion Builder plugin (all versions through 3.16) is also installed and active. A chain of missing authorization (CWE-862) and input validation weaknesses across the two components allows unauthenticated attackers to write attacker-controlled files to the server. Because the attacker can create and execute arbitrary PHP files, successful exploitation leads to remote code execution and complete site compromise. Exploitation requires both components to be active and certain administrator-authored content to be present, narrowing the practical attack surface. No public proof of concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.6% chance of exploitation within 30 days.

Do: Update Avada to a version later than 7.16 and the bundled Fusion Builder plugin to a version later than 3.16, ensuring both components are patched together. Since the flaw is exploitable without authentication, sites that cannot patch immediately should apply a WAF/virtual patch and audit writable directories and uploads folders for unexpected PHP files. After patching, review the administrator-authored content referenced by the vulnerable code paths and check logs for unauthenticated requests writing files to the server.

The Pods – Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) routes every access check on its pods_admin AJAX router — the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which in the JSON meta-box-loader compatibility path only writes a PHP error-log entry and returns false instead of terminating the request. As a result, an unauthenticated request sent through this AJAX path passes all of the plugin's guards without being stopped and can invoke privileged administrator actions. An attacker can escalate to Administrator or overwrite the password of any user account, including the site owner's, achieving complete site takeover or performing other administrator-level actions. Any WordPress site running an affected version of the plugin is exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, though the 9.8 CVSS score and elevated EPSS (2.8%, 86th percentile) make it a high-priority patching target.

Do: Update the Pods plugin to a release newer than 3.3.9 as soon as a patched version is published (no fixed version is named in the disclosure), or deactivate the plugin until then. Audit the WordPress users list for unexpected Administrator accounts and verify that admin passwords have not been changed, since successful exploitation enables full site takeover. As an interim measure, a WAF rule restricting unauthenticated access to the pods_admin route on admin-ajax.php can reduce exposure.

TranslatePress – Translate Multilingual sites with AI Translation for WordPress, in all versions up to and including 3.3.1, leaks sensitive data through its unauthenticated 'trp_get_translations_regular' AJAX action (CWE-640). When automatic string saving is enabled (the plugin's default) and an administrator's profile locale is set to a published secondary language, the raw password-reset URL — containing the plaintext reset key and login parameters — is persisted in the secondary-language translation dictionary table. An unauthenticated attacker can then retrieve these stored strings via the AJAX endpoint and use the leaked reset key to take over the administrator account. Any WordPress site running the affected versions under those configuration conditions is exposed. No public proof-of-concept or confirmed exploitation is known; the flaw is not in CISA KEV and EPSS estimates a 0.8% probability of exploitation within 30 days.

Do: Update TranslatePress to a release newer than 3.3.1 as soon as a patched version is available. Until then, disable automatic string saving or ensure administrator profiles are not set to published secondary-language locales, and inspect secondary-language translation dictionary tables for stored password-reset URLs. If any reset URLs were stored, trigger fresh password resets for affected administrator accounts to invalidate the exposed reset keys.

CVE-2026-76581 is a critical authentication bypass (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.1, caused by inconsistent HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions: step 1 signs an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1, move the domain value into the redirect field, and replay the signature to step 2, which accepts it and returns an authenticated administrator session. Only sites connected to WPMU DEV with Hub single sign-on (SSO) enabled and mapped to an administrator account are exploitable, and a successful attack grants full admin access, typically enabling complete site takeover. No exploitation has been reported: the flaw is not in CISA KEV, EPSS estimates a 0.3% probability of exploitation within 30 days, and no public proof-of-concept is known.

Do: Update the WPMU DEV Dashboard plugin to a patched release newer than 5.0.1 as soon as one is available. Until patched, disable Hub SSO (or ensure it is not mapped to an administrator account) to eliminate the bypass path, and review web logs for unauthenticated admin-ajax.php requests invoking the wdpsso_step1/wdpsso_step2 actions.

CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

Do: Immediately update GiveWP to the latest patched release (any version newer than 4.16.7.1); verify the installed version on the WordPress plugins admin page before and after updating. If updating is not yet possible, temporarily deactivate or restrict access to the plugin's public endpoints and review web and PHP logs for unexpected serialized payloads or newly created admin users and unknown files indicative of object-injection exploitation. Continue monitoring, as a public PoC is available and weaponization could raise the exploitation risk even though EPSS is currently low.