Critical Security Vulnerabilities Discovered in WordPress Plugins and Themes
Recent revelations have unveiled a host of severe security vulnerabilities afflicting various WordPress plugins and themes, notably WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP.
These flaws pose significant risks, including the potential for authentication bypass, account compromise, and arbitrary code execution.
According to analyses by Wordfence and Patchstack, the vulnerabilities identified are as follows:
- CVE-2026-76581 (CVSS score: 9.8) – A critical flaw within the WPMU DEV Dashboard plugin that permits unauthenticated attackers to gain administrator access.
This vulnerability specifically affects configurations with Hub Single-Sign On (SSO) enabled and mapped to an administrator. (Impacts all versions up to and including 5.0.1) - CVE-2026-18431 (CVSS score: 9.8) – An arbitrary file writing vulnerability in the Avada theme, allowing unauthenticated attackers to write files they control to the server.
This flaw can be exploited to create and execute arbitrary PHP files, leading to remote code execution and complete site compromise. (Affects all versions up to, and including, 7.16, especially when the Fusion Builder plugin is installed and operational in versions up to, and including, 3.16) - CVE-2026-19632 (CVSS score: 9.8) – A flaw in the “TranslatePress – Translate Multilingual Sites with AI Translation” plugin that exposes sensitive information, allowing unauthenticated attackers to access the raw administrator password-reset URL, including the plaintext reset key and login parameters.
This vulnerability facilitates full administrator account takeover. (Impacts all versions up to, and including, 3.3.1 when automatic string saving is active and the targeted administrator’s profile locale is set to a published secondary language) - CVE-2026-19598 (CVSS score: 9.8) – This privilege escalation vulnerability in the “Pods – Custom Content Types and Fields” plugin permits unauthenticated attackers to elevate their privileges to that of an Administrator or alter the password of any user account, including that of the site owner, thereby enabling complete site takeover. (Affects all versions up to, and including, 3.3.9)
- CVE-2026-82222 (CVSS score: 10.0) – A vulnerability in the GiveWP plugin allows attackers to execute arbitrary commands on the server of any GiveWP site featuring one published donation form and one active payment gateway. (Impacts all versions up to, and including, 4.16.7.1)
Commenting on CVE-2026-82222, Patchstack noted: The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships.
This illustrates how PHP object injection culminates in remote code execution when three elements align: a location for an attacker-controlled serialized object, code that unsuspectingly unserializes it, and a gadget chain in loaded classes.
The underlying issues are prevalent: reliance on a serialization sanitizer that inadequately purges objects, unserializing data retrieved from the database as though it were secure, and deploying development-only libraries into production environments, where they facilitate pre-existing gadget chains.
Source link: Thehackernews.com.
