Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution.
The vulnerabilities, according to Wordfence and Patchstack, are listed below –
- CVE-2026-76581 (CVSS score: 9.8) – An authentication bypass flaw in the WPMU DEV Dashboard plugin that could allow an unauthenticated attacker, on sites connected to WPMU DEV with Hub Single-Sign On (SSO) enabled and mapped to an administrator, to obtain administrator access and achieve site takeover. (Affects all versions up to, and including, 5.0.1)
- CVE-2026-18431 (CVSS score: 9.8) – An arbitrary file write flaw in the Avada theme for WordPress that makes it possible for an unauthenticated attacker to write attacker-controlled files to the server, which, in turn, can be exploited to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. (Affects all versions up to, and including, 7.16, when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16)
- CVE-2026-19632 (CVSS score: 9.8) – A sensitive information exposure flaw in the “TranslatePress – Translate Multilingual sites with AI Translation” plugin that could allow an unauthenticated attacker to extract the raw administrator password-reset URL, including the plaintext reset key and login parameters, and enable full administrator account takeover. (Affects all versions up to, and including, 3.3.1 only when automatic string saving is enabled and the target administrator’s profile locale is set to a published secondary language)
- CVE-2026-19598 (CVSS score: 9.8) – A privilege escalation flaw in the “Pods – Custom Content Types and Fields” plugin that allows an unauthenticated attacker to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner’s, resulting in complete site takeover. (Affects all versions up to, and including, 3.3.9)
- CVE-2026-82222 (CVSS score: 10.0) – A vulnerability in the GiveWP plugin that allows an attacker to execute arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway. (Affects all versions up to, and including, 4.16.7.1)
“The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships,” Patchstack said about CVE-2026-82222. “This case shows how PHP object injection turns into remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes.”
“The root causes are common: trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.”
