Critical WordPress flaws put plugin and theme sites at risk

Five critical vulnerabilities in WordPress plugins and themes could enable authentication bypass, administrator account takeover, arbitrary file writes, and remote code execution. The affected products are WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. Four flaws are rated CVSS 9.8, while the GiveWP issue, CVE-2026-82222, has a CVSS score of 10.0.

The affected versions span WPMU DEV Dashboard through 5.0.1, Avada through 7.16 in a specified Fusion Builder configuration, TranslatePress through 3.3.1 under particular settings, Pods through 3.3.9, and GiveWP through 4.16.7.1. The findings were disclosed by Wordfence and Patchstack.

Paths to administrator access and server control

CVE-2026-76581 is an authentication bypass in WPMU DEV Dashboard. An unauthenticated attacker could obtain administrator access when a site is connected to WPMU DEV, Hub Single-Sign On is enabled, and the SSO mapping points to an administrator account.

In Avada, CVE-2026-18431 is an arbitrary file write vulnerability. It affects installations with Fusion Builder installed and active through version 3.16. An attacker could write controlled files to the server and use that capability to create and execute PHP files, leading to remote code execution and full site compromise.

TranslatePress issue CVE-2026-19632 can expose a raw administrator password-reset URL, including the plaintext reset key and login parameters. Exploitation requires automatic string saving to be enabled and the target administrator profile locale to be set to a published secondary language. The resulting reset information could enable takeover of the administrator account.

CVE-2026-19598 in Pods permits an unauthenticated attacker to elevate privileges to Administrator or overwrite the password of any user, including the site owner. Either outcome can place the entire WordPress installation under an attacker’s control.

GiveWP deserialization chain

GiveWP vulnerability CVE-2026-82222 allows arbitrary command execution on sites with one published donation form and one active payment gateway. Patchstack described a chain involving a broken “safe unserialize” helper, a donation flow that provides attacker-controlled data to that helper, and a gadget chain in code shipped with GiveWP.

Patchstack said PHP object injection becomes remote code execution when an attacker-controlled serialized object can be stored, later unserialized by application code, and processed through a gadget chain in loaded classes. It identified misplaced trust in a serialization sanitizer, treating database data as trusted during unserialization, and production inclusion of development-only libraries as contributing root causes.

Business implication

Organizations running WordPress should identify these components and versions, check the configuration conditions specified for each flaw, and prioritize remediation of exposed installations. Security teams should also review administrator accounts, password-reset activity, donation workflows, and unexpected server-side files to determine whether compromise indicators require investigation.