Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover, RCE

Five critical WordPress vulnerabilities surfaced together, according to a report from The Hacker News citing research from Wordfence and Patchstack. Each flaw affects a different, widely deployed plugin or theme: the WPMU DEV Dashboard plugin, the Avada theme paired with its required Fusion Builder plugin, TranslatePress, Pods, and GiveWP.

Every one of the five CVEs carries a CVSS score of 9.8, except GiveWP's flaw which scores a maximum 10.0. None require the attacker to hold valid credentials, which is the detail that ties this otherwise unrelated batch together. A site owner running any one of these products in a vulnerable version faces a direct path to administrator access or server-side code execution.

CVE-2026-18431 is a chain of six separate weaknesses in the Avada theme and its companion Fusion Builder plugin that Wordfence's research team, using an internal tool called Argus, discovered and reproduced in about two hours. The chain moves from an exposed public request, through functionality that should require authentication, into a privileged component, and finally bypasses file-handling restrictions to write and execute arbitrary PHP.

• Exposing attacker-controlled input through a public request
• Passing that input to functionality restricted from anonymous users
• Invoking a privileged component outside its intended context
• Using request data to influence trusted state
• Accessing an insufficiently protected administrative operation
• Bypassing file-handling restrictions on what could be written and where

Wordfence told BleepingComputer that Fusion Builder is effectively bundled with every Avada install, so the prerequisite of running both products does not shrink the pool of exploitable sites. With Avada reporting more than one million sales, the practical target surface is large. ThemeFusion acknowledged Wordfence's report and shipped fixed versions in Avada 7.16.1 and Fusion Builder 3.16.1.

CVE-2026-82222, the GiveWP flaw, scores a full 10.0 CVSS because it requires only a site with one published donation form and one active payment gateway. Patchstack described the root cause as three ingredients lining up: a broken "safe unserialize" helper that fails to actually strip PHP objects, a donation flow that feeds that helper attacker-controlled data, and a gadget chain present in code GiveWP ships.

Patchstack framed the underlying pattern as familiar: trusting a serialization sanitizer that does not strip objects, unserializing data pulled back from the database as if it were trusted, and shipping development-only libraries into production where they act as ready-made gadget chains. That combination turns routine PHP object injection into full remote code execution once an attacker submits a crafted donation payload.

The WPMU DEV Dashboard flaw, CVE-2026-76581, only affects sites connected to WPMU DEV with Hub Single-Sign-On enabled and mapped to an administrator account, but where that condition holds, an unauthenticated attacker can obtain full administrator access. It affects all versions up to and including 5.0.1.

CVE-2026-19632 in TranslatePress exposes the raw, plaintext administrator password-reset URL, but only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language. CVE-2026-19598 in Pods is broader: an unauthenticated attacker can escalate to Administrator or overwrite any user's password, including the site owner's, on all versions up to 3.3.9, with no special configuration required.

None of these five vulnerabilities require a login, a phishing click, or social engineering. That removes the usual defensive assumption that an attacker first needs stolen credentials or an insider mistake. For MSPs and agencies managing dozens or hundreds of client sites, a single unpatched theme or plugin instance can mean full compromise with no warning signs beforehand.

The CyberExperts analysis of the Avada case argues the wider lesson: operators who sort risk by category, theme versus plugin versus core, miss the point, because attackers care about reachable code paths, not labels. A theme with a required companion plugin and a million sales is, in practice, exposed application infrastructure rather than cosmetic design software.

Update each affected product to its fixed release without waiting for a routine maintenance window: WPMU DEV Dashboard beyond 5.0.1, Avada to 7.16.1 with Fusion Builder to 3.16.1, TranslatePress beyond 3.3.1, Pods beyond 3.3.9, and GiveWP beyond 4.16.7.1. A related, separately disclosed Elementor Pro flaw, CVE-2026-32475, was fixed in version 4.2.2 on August 19, 2026, after researcher Tin Pham reported a file-upload validation bypass through Patchstack.

1. Inventory every site running Avada and confirm the installed Fusion Builder version, since the two ship together.
2. Update GiveWP-powered donation sites even if only one form is live, since that is enough to meet the exploitation condition.
3. Disable automatic string saving in TranslatePress or audit administrator profile locales until the plugin is updated.
4. Review recent administrator account creation, unexpected redirects, and unfamiliar PHP files in upload directories as signs of prior compromise.

Five unauthenticated critical flaws across Avada, GiveWP, Pods, TranslatePress and WPMU DEV Dashboard let attackers take over sites or run code without a login, and unpatched installs remain exploitable until updated.

Security: All five CVEs are rated 9.8 or 10.0 CVSS and require no authentication or user interaction, making them attractive for mass automated scanning once technical detail circulates.

Privacy: TranslatePress's flaw can expose an administrator's plaintext password-reset URL, and GiveWP's flaw runs on sites handling donor payment data.

Wordfence and Patchstack disclosed five critical, unauthenticated WordPress CVEs spanning WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, and GiveWP, each rated 9.8 or 10.0 CVSS.