"The flaw chains a broken 'safe unserialize' helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships," Patchstack said about CVE-2026-82222.
Security researchers at Wordfence and Patchstack have disclosed five critical vulnerabilities across widely used WordPress plugins and themes that—taken together—create straightforward paths to account takeover, remote code execution, and full site compromise. The flaws carry near-maximum severity ratings (CVSS 9.8–10.0) and affect specific, enumerated versions of WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP.
CVE-2026-76581: WPMU DEV Dashboard — authentication bypass that produces site takeover
CVE-2026-76581 (CVSS 9.8) is described as an authentication bypass in the WPMU DEV Dashboard plugin. According to the advisory, an unauthenticated attacker targeting sites that are connected to WPMU DEV with Hub Single-Sign On (SSO) enabled and mapped to an administrator could obtain administrator access and achieve a full site takeover. The vulnerability affects all versions up to, and including, 5.0.1.
CVE-2026-18431: Avada theme — arbitrary file write enabling remote code execution
CVE-2026-18431 (CVSS 9.8) is an arbitrary file write flaw in the Avada theme. The advisory states an unauthenticated attacker can write attacker-controlled files to the server; those files can be used to create and execute arbitrary PHP, yielding remote code execution and complete site compromise. The issue affects all Avada versions up to, and including, 7.16, when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2026-19632: TranslatePress — exposure of raw password-reset URLs
CVE-2026-19632 (CVSS 9.8) is a sensitive information exposure flaw in the "TranslatePress – Translate Multilingual sites with AI Translation" plugin. The vulnerability can allow an unauthenticated attacker to extract the raw administrator password-reset URL, including the plaintext reset key and login parameters, which the advisory warns could enable full administrator account takeover. The issue is limited to versions up to, and including, 3.3.1 only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language.
CVE-2026-19598: Pods — unauthenticated privilege escalation to Administrator
CVE-2026-19598 (CVSS 9.8) affects the "Pods – Custom Content Types and Fields" plugin and permits an unauthenticated attacker to escalate privileges to Administrator or to overwrite the password of any user account, including the site owner's. Patch notes list the affected range as all versions up to, and including, 3.3.9. The advisory frames this as a straightforward path to complete site takeover when exploited.
CVE-2026-82222: GiveWP — PHP object injection to remote code execution
CVE-2026-82222 carries the maximum CVSS score, 10.0, and targets the GiveWP plugin. Patchstack explains this vulnerability requires a site that has one published donation form and one active payment gateway. The researchers say the flaw combines a broken "'safe unserialize' helper," a donation flow that stores attacker-controlled data, and a gadget chain in code bundled with GiveWP, turning PHP object injection into remote code execution. The issue affects all versions up to, and including, 4.16.7.1.
What this means for site owners, plugin maintainers, and security teams
- Site owners and administrators: Sites running the listed versions of WPMU DEV Dashboard (≤5.0.1), Avada (≤7.16 with Fusion Builder ≤3.16 active), TranslatePress (≤3.3.1 under the noted locale and settings), Pods (≤3.3.9), or GiveWP (≤4.16.7.1) are specifically called out as affected; those installations are exposed to account takeover, arbitrary file write, or remote code execution according to the advisories.
- Plugin and theme maintainers: The advisory thread highlights common root causes identified by Patchstack—trusting a serialization sanitizer that fails to strip objects, unserializing database-read data as trusted, and shipping development-only libraries that provide gadget chains. Those technical failings are the places maintainers will need to inspect and remediate in code.
- Security teams and incident responders: The vulnerabilities produce high-confidence, high-impact attack paths (administrator takeover and RCE). Teams responsible for detection and response should prioritize inventories that cross-reference the specific versions enumerated in the advisories and treat affected instances as high-priority risks.
These disclosures, enumerated by Wordfence and Patchstack, are notable for both the breadth of plugins and themes involved and the clarity of the attack vectors: authentication bypasses, arbitrary file writes, exposure of plaintext reset links, privilege escalation, and PHP object injection. Each advisory specifies the exact version ceilings affected, making verification of installed versions the immediate practical step for any operator.
Patchstack's summary — that multiple ingredients lining up can convert serialization and gadget-chain problems into full remote code execution — underlines a technical chain that defenders and developers alike must break. For now, the record is clear: installations matching the affected versions named in the advisories face demonstrable, high-severity risk.
