Five Critical WordPress Plugin Flaws Enable Site Takeover and RCE
Security researchers have disclosed five critical vulnerabilities across popular WordPress plugins and themes that collectively expose millions of websites to authentication bypass, arbitrary code execution, and complete site takeover. The flaws, tracked by Wordfence and Patchstack, affect WPMU DEV Dashboard, the Avada theme, TranslatePress, Pods, and GiveWP—components widely deployed across the WordPress ecosystem. All five carry CVSS scores of 9.8 or higher, underscoring the urgency for site owners who have not yet applied available patches.
The most severe disclosure is CVE-2026-82222, a CVSS 10.0 flaw in the GiveWP donation plugin that chains a broken "safe unserialize" helper with attacker-controlled donation data and a gadget chain in bundled code to achieve remote code execution. According to Patchstack, any GiveWP site running versions up to and including 4.16.7.1 with at least one published donation form and one active payment gateway is exposed to arbitrary command execution. Equally dangerous is CVE-2026-18431 in the Avada theme (versions up to 7.16), where an arbitrary file write vulnerability—exploitable when the Fusion Builder plugin is active up to 3.16—allows unauthenticated attackers to upload and execute PHP files, resulting in full server compromise.
Additional flaws include an authentication bypass in WPMU DEV Dashboard (CVE-2026-76581, affecting versions up to 5.0.1) that grants attackers administrator access on sites with Hub Single-Sign-On enabled, and a privilege escalation in the Pods plugin (CVE-2026-19598, up to 3.3.9) that enables overwriting any user password, including the site owner's. A sensitive information exposure bug in TranslatePress (CVE-2026-19632, up to 3.3.1) leaks raw administrator password-reset URLs containing plaintext reset keys. Administrators should update immediately and audit their environments—using a password checker to verify exposure of reset keys, an email breach checker to confirm whether admin credentials have surfaced in known dumps, and a port scanner to identify any rogue services deployed on compromised hosts.
Patchstack emphasized that the GiveWP flaw illustrates how PHP object injection escalates into RCE when three conditions align: attacker-controlled serialized data, an unserialize sink, and a usable gadget chain. The recurring root causes across all five CVEs—trusting incomplete serialization sanitizers, unserializing database data without validation, and exposing reset tokens through predictable URLs—are common plugin development patterns that defenders should audit in any third-party code running on production sites.