Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

What Happened

Security researchers disclosed five separate critical-severity vulnerabilities across widely used WordPress plugins and a popular commercial theme in the space of about two weeks in August 2026. All five carry a CVSS score of 9.8 or higher (one hits a perfect 10.0), and together they cover the full spectrum of WordPress compromise techniques: authentication bypass, unauthenticated remote code execution, sensitive-information exposure, and privilege escalation. Four of the five were found through Wordfence's bug bounty program or its Argus AI-assisted research tooling; the fifth, GiveWP, was reported through Patchstack.

Combined install base across the five affected products is well over one million WordPress sites.

The Five Flaws

Breaking Down Each Flaw

WPMU DEV Dashboard — Authentication Bypass (CVE-2026-76581)

Affecting roughly 350,000 sites, this flaw lives in the plugin's Hub single sign-on flow. The HMAC signature used to secure the two unauthenticated AJAX steps (wdpsso_step1 and wdpsso_step2) can be constructed by an attacker, letting them complete the SSO handshake as an arbitrary user — including one mapped to an administrator account — without valid credentials. Exploitation requires the site to have WPMU DEV Hub SSO enabled and mapped to an admin account. Wordfence researcher Alex Thomas found the bug on August 19 using the company's Argus AI research tooling; a fix shipped five days later in version 5.0.2.

Avada Theme + Fusion Builder — Chained RCE (CVE-2026-18431)

Avada is one of the best-selling premium WordPress themes on ThemeForest, and it requires its companion Fusion Builder plugin to function — both were affected. Wordfence's Argus system chained six separate weaknesses across the two products into an unauthenticated arbitrary file write, which in turn enables remote code execution. The chain was reproduced on July 30 and disclosed to developer ThemeFusion on August 5; fixes landed in Avada 7.16.1 and Fusion Builder 3.16.1 on August 25. No in-the-wild exploitation had been confirmed as of the disclosure.

TranslatePress — Password Reset Leak (CVE-2026-19632)

TranslatePress, used on roughly 400,000 sites for multilingual content, exposed a password-reset URL (including the reset key) through a public, unauthenticated AJAX action (trp_get_translations_regular) meant only to serve translation dictionaries. An attacker who knows this could retrieve an administrator's reset link and take over the account without ever authenticating. Researcher "momopon1415" reported it through Wordfence's bug bounty program on August 11 for a $975 payout; the fix shipped in 3.3.2 on August 13. Sites should update to 3.3.4 or later, since a separate stored XSS bug (CVE-2026-66582) affects versions through 3.3.2.

Pods — Silent Authorization Failure (CVE-2026-19598)

Pods, a content-type and custom-fields framework used on around 100,000 sites, routes its pods_admin AJAX actions through an access-control function that — due to a logic error — only logs a failed authorization check instead of actually terminating the request. That silent-failure pattern let unauthenticated or low-privileged users reach admin-only actions and escalate privileges. Researcher Nhien Pham of GalaxyOne reported it via Wordfence's bug bounty program, earning a $3,900 reward; it was validated August 12 and fixed in 3.3.9.1 two days later.

GiveWP — Object Injection to RCE (CVE-2026-82222)

The most severe of the five at a perfect CVSS 10.0, this GiveWP flaw chains an unsafe PHP deserialization helper with a bundled gadget chain to achieve full remote code execution on donation-collecting WordPress sites. It's compounded by an unauthenticated registration bypass (give_action=user_register) that lets attackers create an account even when site registration is disabled — removing the usual authentication barrier entirely. Patchstack researcher Udin Chan reported it July 28; GiveWP shipped 4.16.7.2 on August 27 after several rejected patch attempts during a month-long disclosure process. Read our dedicated deep-dive on the GiveWP flaw for the full technical breakdown.

Why This Matters

None of the five vulnerabilities has confirmed in-the-wild exploitation as of publication, but that track record rarely holds for long once a CVE and patch are public — attackers routinely diff patched releases to reverse-engineer working exploits within days. Four of the five bugs were found through proactive researcher programs (Wordfence Bug Bounty, Argus AI-assisted auditing) rather than after real-world incidents, which is a good sign for the ecosystem's defenses but doesn't reduce urgency for site owners still running vulnerable versions.

The common thread across all five is that a single popular plugin or theme compromise can cascade into full site takeover — from a leaked password-reset link, to a silently-failing permission check, to a straightforward RCE chain.

Recommendations

For WordPress Site Owners

• Update immediately if running WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, or GiveWP — all five have patches available now.
• For TranslatePress, update to 3.3.4 or later, not just 3.3.2, to also close the related XSS bug.
• Audit user accounts and admin activity logs for anything unusual dated before your update, particularly for GiveWP (check for unexpected registrations) and TranslatePress (check for unauthorized password resets).

For Agencies and Hosts Managing Client Sites

• Treat this cluster of disclosures as a priority patch sweep across any managed WordPress fleet — check for all five plugins/themes, not just the highest-profile one (GiveWP).
• Where immediate patching isn't possible, consider WAF rules targeting the specific vulnerable AJAX actions named above as a stopgap.

Key Takeaways

1. Five critical WordPress vulnerabilities (CVSS 9.8–10.0) were disclosed within roughly two weeks across WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, and GiveWP.
2. Combined install base across all five products exceeds one million WordPress sites.
3. Four were found via Wordfence's bug bounty program or Argus AI research tooling; GiveWP was reported through Patchstack.
4. Patches are available for all five — the fixes shipped between August 13 and August 27, 2026.
5. No in-the-wild exploitation was confirmed for any of the five at the time of disclosure, but patched vulnerabilities are routinely reverse-engineered into working exploits within days.
6. Site owners and agencies should prioritize a patch sweep across all five products rather than assuming one high-profile flaw (GiveWP) covers the full risk.

Sources

• The Hacker News — Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
• BleepingComputer — Critical Avada WordPress theme flaw enables zero-click RCE
• BleepingComputer — GiveWP WordPress donation plugin flaw lets hackers execute server commands
• Patchstack — Critical Vulnerability Patched in GiveWP Plugin