Security researchers at **Wordfence** and **Patchstack** have recently detailed several critical vulnerabilities impacting popular WordPress plugins and themes. These disclosures highlight persistent security challenges within the WordPress ecosystem, emphasizing the need for prompt updates and vigilant security practices. ### **WPMU DEV Dashboard** Authentication Bypass A critical authentication bypass flaw, tracked as **CVE-2026-76581** (CVSS: 9.8), affects the **WPMU DEV Dashboard** plugin up to version 5.0.1. This vulnerability allows unauthenticated attackers to gain administrator access and potentially achieve complete site takeover if Hub Single-Sign On (SSO) is enabled and mapped to an administrator. ### **Avada** Theme Remote Code Execution The widely used **Avada** theme, up to version 7.16, is susceptible to an arbitrary file write flaw, **CVE-2026-18431** (CVSS: 9.8). When the **Fusion Builder** plugin (up to version 3.16) is active, an unauthenticated attacker can write arbitrary files to the server, ultimately leading to remote code execution (RCE) and full site compromise. ### **TranslatePress** Account Takeover A sensitive information exposure vulnerability, **CVE-2026-19632** (CVSS: 9.8), has been identified in the "**TranslatePress – Translate Multilingual sites with AI Translation**" plugin, affecting versions up to 3.3.1. This flaw allows unauthenticated attackers to extract raw administrator password-reset URLs, including plaintext reset keys and login parameters, facilitating full administrator account takeover. This is exploitable when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language. ### **Pods** Privilege Escalation The "**Pods – Custom Content Types and Fields**" plugin, up to version 3.3.9, contains a privilege escalation flaw, **CVE-2026-19598** (CVSS: 9.8). This allows an unauthenticated attacker to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, leading to complete site takeover. ### **GiveWP** Remote Code Execution Perhaps the most severe of the disclosed flaws is **CVE-2026-82222** (CVSS: 10.0) in the **GiveWP** plugin, affecting versions up to 4.16.7.1. This vulnerability enables unauthenticated attackers to execute arbitrary commands on the server of a **GiveWP** site that has at least one published donation form and one active payment gateway. **Patchstack** elaborated on the **GiveWP** vulnerability, explaining that it chains a broken 'safe unserialize' helper, a donation flow that feeds attacker-controlled data to this helper, and a gadget chain within the plugin's code. This scenario demonstrates how PHP object injection can lead to RCE when three elements align: a storage location for an attacker-controlled serialized object, subsequent code that unserializes it, and a gadget chain in loaded classes. According to **Patchstack**, the root causes are common: "trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains." IT security professionals and website administrators are strongly advised to update these plugins and themes immediately to their patched versions to mitigate the significant risks these vulnerabilities present.