Five WordPress Plugin and Theme Flaws Allow Site Takeover

Security researchers have published details of five critical WordPress plugin and theme vulnerabilities, affecting WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The flaws, reported by Wordfence and Patchstack, range from authentication bypass and privilege escalation to arbitrary file writes and command execution. Site owners who use any of these products should check their versions immediately and watch for vendor patches.

WPMU DEV Dashboard is affected by CVE-2026-76581, an authentication bypass flaw with a CVSS score of 9.8, a standard severity rating where 9.8 means critical. An unauthenticated attacker can obtain administrator access on sites connected to WPMU DEV that have Hub Single Sign-On (SSO) enabled and mapped to an administrator. The flaw affects all versions up to and including 5.0.1.

The Avada theme carries CVE-2026-18431, also scored 9.8. This is an arbitrary file write flaw that lets an unauthenticated attacker write attacker-controlled files to the server. By doing so, the attacker can create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. The issue affects all versions up to and including 7.16 when the Fusion Builder plugin is installed and active in versions up to and including 3.16.

TranslatePress is affected by CVE-2026-19632, likewise scored 9.8. This sensitive information exposure flaw can allow an unauthenticated attacker to extract the raw administrator password-reset URL, including the plaintext reset key and login parameters. With that information, an attacker can take over an administrator account. The vulnerability affects all versions up to and including 3.3.1 only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language.

The Pods plugin has CVE-2026-19598, a privilege escalation flaw scored 9.8. An unauthenticated attacker can escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, leading to complete site takeover. All versions up to and including 3.3.9 are affected.

GiveWP is affected by CVE-2026-82222 with the highest possible CVSS score of 10.0. The vulnerability allows an attacker to execute arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway. According to Patchstack, the flaw chains a broken safe unserialize helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships. This shows how PHP object injection turns into remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes. Patchstack also named common root causes: trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.

These vulnerabilities are serious because they can give an outsider the same control as a site owner. An authentication bypass or privilege escalation means someone can log in as an administrator without a password. Arbitrary file write and command execution mean the attacker can run their own code on the hosting server, which can be used to plant malware, steal data, or use the server for further attacks. For hosting providers and site owners, that makes prompt patching and configuration review essential.

The disclosures list affected version ranges but do not specify which releases contain the fixes. Site owners should check the plugin and theme vendor pages, as well as the Wordfence and Patchstack advisories, for official patch information as it appears. While waiting for updates, administrators can reduce risk by disabling any affected plugin or theme where possible, and by reviewing settings such as SSO mappings, automatic string saving, and payment gateway configurations.

For owners who prefer a provider to manage their WordPress installation, AEU Hosting offers managed WordPress hosting, which can include handing off update and security tasks to the hosting team. That kind of support can reduce the chance of running a known-vulnerable plugin for long after a disclosure.