Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

1. Executive summary

Five critical vulnerabilities have been disclosed in widely deployed WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — reported by Wordfence and Patchstack. Four carry CVSS 9.8 and one (CVE-2026-82222 in GiveWP) carries CVSS 10.0; all are exploitable by unauthenticated attackers and lead to administrator account takeover or remote code execution. None of the five is currently listed in CISA's Known Exploited Vulnerabilities catalogue, and CVE-2026-76581 shows an EPSS score of 0% at time of writing — exploitation likelihood is currently assessed as low, but the impact ceiling is full site compromise. For EMEA financial services, the exposure is any internet-facing WordPress estate: marketing sites, microsites, and donation or content portals that sit outside the core transaction estate but can be leveraged for defacement, phishing infrastructure, or as a foothold into shared hosting. Patch on the schedule in §4; treat WordPress CMS as internet-facing attack surface in its own right, not as "just a website."

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item: the vulnerabilities are unpatched disclosure items with no confirmed incident, and the generic fact that "patching is required" does not trigger incident-reporting duties. If exploitation is subsequently confirmed on a client asset, NIS2 Art. 23 and the UK NIS 2018 OES/RDSP duties should be reassessed at that point.

3. Technical analysis & attack chain

Prioritised triage table (ordered by severity and exploitability; none of the five is in CISA KEV, and CVE-2026-76581 carries EPSS 0% per verified reference data — EPSS for the remaining four was not available in the supplied data):

Mechanism depth — the two most urgent entries

CVE-2026-82222 (GiveWP, CVSS 10.0). Patchstack describes a three-part chain that converts PHP object injection into remote code execution:

1. A donation flow feeds attacker-controlled data into a "safe unserialize" helper that does not actually strip objects from the serialized payload — the sanitizer is trusted but ineffective.
2. The attacker-controlled serialized object is stored (a place to persist the payload), then later read back from the database and unserialized as if it were trusted data.
3. GiveWP ships development-only libraries into production, which provide ready-made gadget chains in loaded classes; when the unserialized object instantiates, the gadget chain executes arbitrary commands on the server.

Preconditions are minimal and match any operational GiveWP deployment: one published donation form and one active payment gateway. The root causes Patchstack names — a serialization sanitizer that fails to strip objects, unserializing database-read data without validation, and shipping dev-only libraries to production — are worth checking for in any in-house PHP code that mirrors this pattern.

CVE-2026-18431 (Avada + Fusion Builder, CVSS 9.8). An unauthenticated arbitrary file write: the attacker writes attacker-controlled files to the server, then exploits that write to create and execute arbitrary PHP files, yielding remote code execution and complete site compromise. Exploitability requires Avada up to and including 7.16 with the Fusion Builder plugin installed and active in versions up to and including 3.16 — a common bundled configuration for Avada sites.

Remaining entries (conditions matter for triage)

• CVE-2026-19598 (Pods, CVSS 9.8): unauthenticated privilege escalation to Administrator, or direct overwrite of any user account's password including the site owner's — either path is complete site takeover. Affects Pods up to and including 3.3.9.
• CVE-2026-19632 (TranslatePress, CVSS 9.8): exposes the raw administrator password-reset URL, including the plaintext reset key and login parameters, to an unauthenticated attacker, enabling full administrator account takeover. Exploitable only when automatic string saving is enabled AND the target administrator's profile locale is set to a published secondary language — check both settings before assuming exposure. Affects TranslatePress up to and including 3.3.1.
• CVE-2026-76581 (WPMU DEV Dashboard, CVSS 9.8): authentication bypass allowing an unauthenticated attacker to obtain administrator access on sites connected to WPMU DEV with Hub Single-Sign On (SSO) enabled and mapped to an administrator. Affects versions up to and including 5.0.1. Per verified NVD data this is CWE-347 (Improper Verification of Cryptographic Signature); the source describes it only as an authentication bypass, which is consistent with a signature-verification failure in the SSO handshake.

Confirmed attack chain (generic to the takeover-class flaws): (1) unauthenticated attacker reaches the vulnerable plugin/theme endpoint on an internet-facing WordPress site; (2) exploits the specific flaw — signature-verification bypass (WPMU DEV), file write (Avada), reset-URL disclosure (TranslatePress), privilege escalation/password overwrite (Pods), or object injection (GiveWP); (3) obtains administrator or code-execution capability; (4) achieves complete site takeover. Post-compromise behaviour (persistence, C2, lateral movement, exfiltration) is not described in the source material — no malware, C2 infrastructure, or attacker attribution is claimed, and none should be assumed.

Confidence caveat: all technical detail above is single-sourced — it derives from one The Hacker News article aggregating Wordfence and Patchstack advisories. The CVSS scores and CWE classification for CVE-2026-76581 are corroborated by verified NVD reference data; the mechanisms for the other four CVEs rest on the vendor advisories as reported. Verify against the original Wordfence and Patchstack advisories before enforcement action.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory and patch GiveWP (CVE-2026-82222, CVSS 10.0). Any site running GiveWP up to and including 4.16.7.1 with a published donation form and an active payment gateway is presumptively exploitable. Update to a version later than 4.16.7.1; if no fixed version is yet deployed, disable the plugin or take the donation form offline. If immediate patching is impossible, place a WAF rule blocking unauthenticated POSTs to the donation-flow endpoints as interim containment.
2. Patch Avada/Fusion Builder (CVE-2026-18431). Update Avada beyond 7.16 and Fusion Builder beyond 3.16. Where the theme cannot be updated immediately, deactivate Fusion Builder — the flaw requires it installed and active.
3. Patch Pods (CVE-2026-19598). Update Pods – Custom Content Types and Fields beyond 3.3.9. Until patched, review all administrator accounts and any unexpected password changes; the flaw permits silent password overwrite of any user.

P2 — within 72 hours

4. Patch TranslatePress (CVE-2026-19632). Update beyond 3.3.1. Separately, audit configuration: if automatic string saving is enabled and any administrator profile locale is set to a published secondary language, treat that site as exposed and rotate administrator credentials and reset keys regardless of patch status.
5. Patch WPMU DEV Dashboard (CVE-2026-76581). Update beyond 5.0.1. On sites connected to WPMU DEV, audit the Hub SSO configuration: if SSO is enabled and mapped to an administrator account, disable the mapping or the SSO integration until patched, and review authentication logs for anomalous admin logins.

P3 — within 7 days

6. Estate-wide WordPress hygiene. Run a plugin/theme version sweep across all WordPress properties (marketing, microsites, portals) — these five flaws demonstrate that CMS plugins are unauthenticated pre-auth attack surface. Where a plugin or theme is abandoned or cannot be patched, remove it.
7. Post-patch verification. For any site that was running a vulnerable version, check for unauthorised administrator accounts, modified theme/plugin PHP files (the Avada flaw writes arbitrary PHP), and unexpected uploaded files outside wp-content/uploads norms.

No CISA KEV remediation due-dates apply — none of these CVEs is in the KEV catalogue.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (derived from vulnerability mechanics described in the source; no atomic IOCs were published):

6. Detection

Insufficient indicators to author detection rules.

The source material describes vulnerability mechanisms only; it contains no strings, filenames, registry keys, command-line artefacts, or other threat artefacts from which a YARA or Sigma rule could be built without fabrication.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE," https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html, 2026-08-29 (reporting advisories from Wordfence and Patchstack)

8. Adverse Trace position

All five flaws are rated CRITICAL (CVSS 9.8 × 4, CVSS 10.0 × 1) per verified reference data, and every one is exploitable unauthenticated — but none is in CISA KEV and CVE-2026-76581 shows EPSS 0%, so we assess this as a high-impact, currently low-observed-exploitation disclosure rather than an active campaign. Attribution is not claimed by any source and none should be inferred. The practical risk to EMEA financial services is concentrated in the non-transactional web estate — marketing sites, donation portals, multilingual microsites — where WordPress plugin hygiene is historically weak and a takeover yields phishing infrastructure or a defacement headline rather than direct financial loss; the GiveWP flaw is the most urgent because its preconditions match any live deployment. All technical detail in this advisory is single-sourced from one vendor-advisory aggregation: verify against the original Wordfence and Patchstack advisories, and confirm fixed-version numbers in the WordPress plugin/theme repositories, before enforcement or client notification. We will monitor for KEV listing, EPSS movement, and any public exploit or in-the-wild reporting, and will reissue if exploitation is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.