Multiple critical security vulnerabilities have been disclosed in widely-used WordPress plugins and themes including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The flaws, tracked by Wordfence and Patchstack, can lead to authentication bypass, account takeover, and arbitrary remote code execution. At least one CVE, CVE-2026-76581, carries a near-maximum CVSS score of 9.8. The vulnerabilities span authentication bypass and potentially other critical classes. Successful exploitation could allow attackers to fully compromise affected WordPress sites. Site administrators are urged to apply patches immediately to mitigate risk of site takeover or RCE.
Five critical vulnerabilities were disclosed in WordPress plugins and themes: (1) CVE-2026-76581 in WPMU DEV Dashboard plugin - an authentication bypass flaw exploitable when Hub SSO is enabled and mapped to an administrator, allowing unauthenticated attackers to gain administrator access. (2) CVE-2026-18431 in the Avada theme - an arbitrary file write vulnerability when Fusion Builder plugin is active, enabling unauthenticated attackers to write attacker-controlled PHP files to the server and achieve remote code execution. (3) CVE-2026-19632 in TranslatePress plugin - a sensitive information exposure flaw that leaks the raw administrator password-reset URL including the plaintext reset key, exploitable when automatic string saving is enabled and the target admin's locale is set to a published secondary language. (4) CVE-2026-19598 in Pods plugin - an unauthenticated privilege escalation flaw allowing attackers to escalate to Administrator or overwrite any user account password. (5) CVE-2026-82222 in GiveWP plugin (CVSS 10.0) - a PHP object injection vulnerability leading to RCE, chaining a broken 'safe unserialize' helper, attacker-controlled donation flow data, and a gadget chain in GiveWP-shipped code. The root causes include trusting a serialization sanitizer that does not strip objects, unserializing database data as if trusted, and shipping development-only libraries with ready-made gadget chains into production.
1. Update WPMU DEV Dashboard plugin to a version beyond 5.0.1. Disable Hub Single-Sign On (SSO) if not required until patched. 2. Update the Avada theme to a version beyond 7.16 and Fusion Builder plugin beyond 3.16. Avoid running unpatched versions with Fusion Builder active. 3. Update TranslatePress plugin to a version beyond 3.3.1. Disable automatic string saving if possible, or restrict secondary language locale settings for administrator accounts until patched. 4. Update Pods plugin to a version beyond 3.3.9. Monitor for unexpected privilege escalation or unauthorized password changes. 5. Update GiveWP plugin to a version beyond 4.16.7.1. Review server for signs of PHP object injection or unauthorized command execution. Audit all WordPress plugins and themes regularly for available security updates. Remove development-only libraries from production environments. Implement web application firewall (WAF) rules to detect and block PHP object injection attempts and suspicious file write operations.
