Researchers from Wordfence and Patchstack have disclosed five critical vulnerabilities (CVSS 9.8–10.0) in widely used WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The combined user base of the affected products exceeds 1.8 million installations and sales. All of the vulnerabilities allow an unauthenticated attacker to obtain administrative access, hijack an account, or execute arbitrary code on the server. Patches are already available for all affected products — WordPress site administrators should update the relevant components immediately.
Technical analysis of the vulnerabilities
CVE-2026-76581 — authentication bypass in WPMU DEV Dashboard
According to Wordfence, the vulnerability with a CVSS score of 9.8 affects all versions of the WPMU DEV Dashboard plugin up to and including 5.0.1. The plugin has around 350,000 active installations. An unauthenticated attacker can obtain an administrator session and full control over the site if two conditions are met: the site is connected to the WPMU DEV Hub with single sign-on (SSO) enabled, and SSO is linked to an administrator account. The fix was released on 24 August 2026 in version 5.0.2.
CVE-2026-18431 — remote code execution via Avada
An arbitrary file write vulnerability in the Avada theme (over 1 million sales) has been assigned a CVSS score of 9.8. As Wordfence describes, exploitation requires a chain of six separate weaknesses that have to be combined sequentially. Versions of Avada up to and including 7.16 are affected when used together with the Fusion Builder plugin versions up to and including 3.16. An additional prerequisite is the presence of specific content created by an administrator. An attacker can write attacker-controlled PHP files to the server and achieve their execution. Notably, the Wordfence Argus research system, according to the company, discovered and reproduced the entire chain in roughly two hours. The fixed versions — Avada 7.16.1 and Fusion Builder 3.16.1 — were released on 25 August 2026. Both components must be updated.
CVE-2026-19632 — account takeover via TranslatePress
A sensitive information disclosure vulnerability in the TranslatePress plugin (over 400,000 active installations) has also been rated CVSS 9.8. According to the Wordfence report, an unauthenticated attacker can extract the full administrator password reset URL, including the reset key in cleartext and login parameters. This makes it possible to fully take over the administrator account. The exploitation conditions are fairly narrow: the automatic string translation saving feature must be enabled, and the target administrator’s profile must be using a published secondary language. Versions up to and including 3.3.1 are affected. The patch — version 3.3.2 — was released on 13 August 2026.
CVE-2026-19598 — privilege escalation in Pods
A privilege escalation vulnerability in the Pods – Custom Content Types and Fields plugin (over 100,000 active installations) with a CVSS score of 9.8 allows an unauthenticated attacker to escalate their privileges to administrator level or overwrite any user’s password, including the site owner’s. According to Wordfence, the developer coordinated a forced update together with the WordPress.org team. Fixed versions for the different branches — 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3, and 3.3.9.1 — were released on 14 August 2026. Administrators should check which branch is installed and ensure that the correct patch has been applied.
CVE-2026-82222 — PHP object injection in GiveWP
The vulnerability in the GiveWP plugin affects versions up to and including 4.16.7.1 and, according to the original Patchstack material, is associated with a chained attack: unauthenticated PHP object injection leading to remote code execution. It should be noted that the details of this vulnerability, including the stated CVSS score and patch information, have not been independently verified through primary sources. Patchstack points to three root causes: a serializer that does not strip objects, deserialization of data from the database without trust checks, and the presence of libraries with ready-made gadget chains in the production build.
Impact assessment
The overall scale of potential impact is significant: sites with a combined total of more than 1.8 million installations and sales are affected. However, the degree of actual exposure varies considerably. The WPMU DEV Dashboard vulnerability requires a specific SSO configuration, Avada exploitation depends on the presence of Fusion Builder and certain content, and TranslatePress is only vulnerable when automatic string saving is enabled and a secondary language is used in the administrator profile. The most broadly exploitable vulnerability is potentially the one in Pods, where the exploitation conditions are, based on available data, less restrictive.
Active exploitation of any of the listed vulnerabilities in real-world attacks has not been confirmed as of the time of publication. Nevertheless, the critical CVSS ratings and the possibility of unauthenticated exploitation make these vulnerabilities a priority for prompt remediation.
Remediation recommendations
- WPMU DEV Dashboard — update to version 5.0.2 or later; temporarily disable Hub SSO if an immediate update is not possible
- Avada + Fusion Builder — update both components: the theme to 7.16.1 and the plugin to 3.16.1; updating only one of them does not eliminate the exploitation chain
- TranslatePress — update to version 3.3.2; as a temporary measure, disable automatic string saving
- Pods — check which branch is installed and update to the corresponding fixed version (3.3.9.1 for the 3.3.x branch); ensure that the forced update from WordPress.org has been applied
- GiveWP — check for an update to the latest version via the WordPress admin dashboard
- Review access logs for anomalous requests to SSO, password reset, and REST API endpoints for the period leading up to the publication of the patches
- Check the list of users with administrative privileges for any unauthorized accounts
All four verified vulnerabilities have a CVSS score of 9.8, allow unauthenticated exploitation, and already have patches available. The update priority is maximal. WordPress site administrators using any of the listed components should apply the fixes within hours rather than days and perform a retrospective review for signs of compromise, bearing in mind that between the disclosure of the vulnerabilities and the release of patches, from several days to a week elapsed.
