Five WordPress plugin vulnerabilities allow site takeover

Five critical WordPress plugin vulnerabilities, plus one in a widely used theme, could let attackers take over websites, according to advisories from the security companies Wordfence and Patchstack. The affected products are the WPMU DEV Dashboard plugin, the Avada theme together with its Fusion Builder plugin, the TranslatePress multilingual plugin, the Pods custom content types plugin and the GiveWP donation plugin. Severity scores run from 9.8 to a maximum of 10.0, and the reported outcomes include authentication bypass, account takeover and arbitrary code execution.

For readers who do not work with websites every day, a few definitions help. WordPress is the software that runs a large share of the world's sites, and a plugin is an add-on that gives it a feature, such as a donation form or a translation tool, while a theme controls how the site looks. A vulnerability is a mistake in that code which an attacker can abuse. Each flaw below has a CVE number, a public catalogue identifier that lets administrators and vendors refer to one specific bug, and a CVSS score, a widely used 0 to 10 scale where a higher number means the flaw is easier to exploit and does more damage. Unauthenticated means the attacker needs no account or password on the site to start, and administrator access means full control of the site.

The first flaw, CVE-2026-76581, carries a CVSS score of 9.8 and is an authentication bypass in the WPMU DEV Dashboard plugin, which owners use to manage sites connected to the WPMU DEV service. Wordfence and Patchstack report that on sites connected to WPMU DEV where Hub Single Sign-On is enabled and mapped to an administrator, an attacker with no account could obtain administrator access and take over the site. The affected range covers all versions up to and including 5.0.1. Single sign-on is a feature that lets one login open several connected services, which is why a mistake in it can hand over such broad access.

The second, CVE-2026-18431, also scores 9.8 and is an arbitrary file write in the Avada theme. In plain terms, the attacker can place files of their own choosing on the web server without logging in. Because those files can be PHP files, the scripting language WordPress uses to build pages, the attacker can then get the server to run them, which the advisories describe as remote code execution and complete site compromise. The conditions matter here: all Avada versions up to and including 7.16 are affected, but only when the Fusion Builder plugin is installed and active in versions up to and including 3.16.

The third, CVE-2026-19632, scores 9.8 and is a sensitive information exposure in the plugin listed as TranslatePress, described as a tool for translating multilingual sites with AI translation. According to the advisories, an unauthenticated attacker could extract the raw administrator password reset URL, which includes the plaintext reset key and the login parameters, and use it for full administrator account takeover. A password reset link is normally sent to the owner's email so that only they can use it; if somebody else can read it, they can set a new password themselves. The affected setup is narrow again: all versions up to and including 3.3.1, but only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language. A locale is the language setting attached to a user's profile.

The fourth, CVE-2026-19598, scores 9.8 and is a privilege escalation in the plugin listed as Pods, the custom content types and fields plugin. The researchers report that an attacker without an account can raise their own privileges to Administrator, or overwrite the password of any user account including the site owner's, which again amounts to complete site takeover. All versions up to and including 3.3.9 are affected. Privilege escalation means starting with little or no access and ending up with much more.

The fifth flaw stands out because it reaches the top of the scale. CVE-2026-82222 carries a CVSS score of 10.0 and affects the GiveWP donation plugin, and it allows an attacker to execute arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway. All versions up to and including 4.16.7.1 are affected. In Patchstack's account of this case, three ingredients line up: a safe unserialize helper that is broken, a donation flow that feeds attacker-controlled data into that helper, and a gadget chain in code that GiveWP ships. Patchstack summed up the lesson as PHP object injection turning into remote code execution when a place to store an attacker-controlled serialized object, code that later unserializes it and a gadget chain in loaded classes all come together. Unserializing is the act of turning stored data back into usable program objects, and it turns dangerous when that data comes from an attacker instead of a trusted source.

Patchstack also named the root causes it saw behind this class of bug. In its description, teams trust a serialization sanitizer that does not actually strip objects, they unserialize data read back from the database as if it were trusted, and they ship development-only libraries into production, where those libraries provide ready-made gadget chains for an attacker to use. That last point is a reminder that code added for convenience while building a product can become a weapon if it stays in the finished release.

For website owners, the practical picture is this. All five problems can be started without the attacker holding a login, which removes the usual first barrier, but most of them need a particular configuration to work, as the conditions above show. The material available for this report describes the affected version ranges but does not state which release fixes each flaw, so the safe approach is to check the current version of each product named here and, if it sits at or below the listed number, to treat the site as exposed until you have confirmed otherwise with the vendor or your hosting provider. Anyone running a shop, a donation page or a membership site should treat this as urgent rather than routine, because administrator access or command execution on the server is the deepest level of compromise a website can suffer: an attacker can read customer data, change content, add hidden pages and keep coming back.

Sites that carry many add-ons are the ones most exposed, and this is an area where managed help makes a difference. AEU Hosting (albhosting.eu) is our managed WordPress hosting service, built specifically for WordPress sites and taking care of the platform side of running them, so owners who would rather not follow plugin advisories themselves can check the service page to see what is included. Whatever hosting a site uses, the same habits help: remove what you do not use, keep what you keep up to date, and make sure you can restore from a backup if something goes wrong.