Critical WordPress Plugin, Theme Flaws
Five critical vulnerabilities in popular WordPress plugins and themes, including WPMU DEV Dashboard and Avada, allow unauthenticated attackers to bypass
Security researchers have disclosed five critical vulnerabilities in widely used WordPress plugins and themes. The flaws, detailed by Wordfence and Patchstack, enable unauthenticated attackers to bypass authentication, escalate privileges, or execute arbitrary code, leading to full site takeover. All affected software vendors have issued patches.
Critical Vulnerabilities Detailed
The vulnerabilities affect the WPMU DEV Dashboard plugin, the Avada theme, and the TranslatePress, Pods, and GiveWP plugins. Each carries a CVSS score of 9.8 or higher.
| CVE Identifier | Component | CVSS Score | Vulnerability Type | Key Condition for Exploit |
|---|---|---|---|---|
| CVE-2026-76581 | WPMU DEV Dashboard plugin | 9.8 | Authentication bypass | Hub SSO enabled and mapped to an administrator. Affects versions up to and including 5.0.1. |
| CVE-2026-18431 | Avada theme | 9.8 | Arbitrary file write | Fusion Builder plugin installed and active in versions up to and including 3.16. Affects theme versions up to and including 7.16. |
| CVE-2026-19632 | TranslatePress plugin | 9.8 | Sensitive information exposure | Automatic string saving enabled and target admin's profile locale set to a published secondary language. Affects versions up to and including 3.3.1. |
| CVE-2026-19598 | Pods plugin | 9.8 | Privilege escalation | Affects all versions up to and including 3.3.9. |
| CVE-2026-82222 | GiveWP plugin | 10.0 | Arbitrary command execution | Site must have one published donation form and one active payment gateway. Affects versions up to and including 4.16.7.1. |
Exploitation Paths and Risks
The CVE-2026-76581 flaw in the WPMU DEV Dashboard plugin allows an unauthenticated attacker to obtain administrator access. This requires the site to be connected to WPMU DEV with Hub Single-Sign On enabled and mapped to an administrator account.
The Avada theme flaw, tracked as CVE-2026-18431, is an arbitrary file write vulnerability. It lets an attacker write controlled files to the server. This can be leveraged to create and execute arbitrary PHP files, resulting in remote code execution.
CVE-2026-19632 in the TranslatePress plugin exposes sensitive information. An unauthenticated attacker can extract a raw administrator password-reset URL, including the plaintext reset key. This enables full administrator account takeover.
The Pods plugin vulnerability, CVE-2026-19598, is a privilege escalation flaw. It allows an unauthenticated attacker to escalate their privileges to Administrator. Alternatively, they can overwrite the password of any user account, including the site owner's.
Analysis of the GiveWP RCE Flaw
The most severe flaw is CVE-2026-82222 in the GiveWP plugin, with a maximum CVSS score of 10.0. It allows an attacker to execute arbitrary commands on the server. Patchstack provided technical analysis of this vulnerability.
"The flaw chains a broken 'safe unserialize' helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships," Patchstack said. They noted this case shows how PHP object injection turns into remote code execution when three ingredients align.
These are a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes. According to Patchstack, the root causes are common. They involve trusting a serialization sanitizer that does not actually strip objects, unserializing data read from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.
