Five Critical Vulnerabilities in WordPress Plugins and Themes Threaten Site Takeover

Specialists at Wordfence and Patchstack have reported five critical vulnerabilities in widely used WordPress plugins and themes. Under the right conditions, each one lets an unauthenticated attacker gain administrator privileges, hijack someone else's account, or execute arbitrary code on the server.

Authentication bypass and privilege escalation

The most dangerous of the “nines” in terms of mass exposure is CVE-2026-76581 (CVSS 9.8) in the WPMU DEV Dashboard plugin. On sites connected to WPMU DEV with Hub Single-Sign-On enabled and bound to an administrator, an attacker can gain administrative access without authenticating. All versions up to and including 5.0.1 are affected.

The Pods — Custom Content Types and Fields plugin (CVE-2026-19598, CVSS 9.8) allows an unauthenticated user to escalate their privileges to administrator or overwrite the password of any account, including the site owner's. Versions up to and including 3.3.9 are vulnerable.

The multilingual plugin TranslatePress (CVE-2026-19632, CVSS 9.8) deserves special mention: with string auto-saving active and a secondary language locale configured for the administrator, an attacker can extract the raw password-reset URL together with its key in cleartext — and thereby take full control of the account. Versions up to and including 3.3.1 are affected.

A path to code execution

The Avada theme (CVE-2026-18431, CVSS 9.8) contains an arbitrary file write vulnerability: with the Fusion Builder plugin installed and active, an attacker can upload files they control to the server, then create and execute PHP code, leading to a full site compromise. Theme versions up to 7.16 and Fusion Builder versions up to 3.16 are vulnerable.

The maximum score — 10.0 — went to a flaw in the donation-collection plugin GiveWP (CVE-2026-82222). It triggers on sites with a single published donation form and at least one active payment gateway, allowing arbitrary commands to be executed on the server.

According to Patchstack, the attack combines three elements at once: a broken “safe” deserializer, a donation flow that feeds it attacker-controlled data, and a ready-made gadget chain in the code shipped by the plugin itself. It's a classic example of how PHP object injection turns into remote code execution when three ingredients come together — a place to store a serialized object, code that later deserializes it, and a suitable gadget chain among the loaded classes.

The researchers stress that most of these problems share the same roots: trusting a serialization sanitizer that doesn't actually strip out objects; deserializing data read from the database as inherently trusted; and shipping into production libraries meant only for development, which hand attackers ready-made gadget chains. Administrators of affected sites are advised to update to the fixed versions as quickly as possible.

Source: The Hacker News