Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.
Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.
- CVE-2026-76581: WPMU DEV Dashboard auth bypass grants admin when Hub SSO is enabled
- CVE-2026-18431: Avada arbitrary file write enables PHP upload and remote code execution
- CVE-2026-19632: TranslatePress exposes password-reset URLs, allowing administrator takeover
- CVE-2026-19598: Pods privilege escalation lets attackers overwrite any user's password
- CVE-2026-82222: GiveWP PHP object injection chains to RCE on sites with donation forms
- Vendors
- WPMU DEVPatchstackWordfence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18431 | Unauthenticated Arbitrary File Write to RCE in Avada WordPress Theme | 9.8 | <1% | ||
| CVE-2026-19598 | Unauthenticated Privilege Escalation in WordPress Pods Plugin Enables Site Takeover | 9.8 | 3% | ||
| CVE-2026-19632 | Unauthenticated Sensitive Information Exposure in TranslatePress WordPress Plugin | 9.8 | <1% | ||
| CVE-2026-76581 | Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier | 9.8 | <1% | ||
| CVE-2026-82222 | Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin | 10.0 | 2% | PoC |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 29, 2026 Vulnerability / Web Security Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below -
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.