WordPress Plugins and Themes Expose Five Critical Flaws Enabling Site Takeover

AI digestMimile.ai EditorialAugust 29, 2026 at 09:25 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

WordPress Plugins and Themes Expose Five Critical Flaws Enabling Site Takeover

Security researchers disclosed five critical vulnerabilities in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The flaws could allow unauthenticated attackers to bypass authentication, escalate privileges, and execute arbitrary code. The most severe vulnerability, CVE-2026-82222 in GiveWP, carries a CVSS score of 10.0.

Key Facts

CVE-2026-82222 in GiveWP has a CVSS score of 10.0 and allows arbitrary command execution on sites with one published donation form and one active payment gateway.
CVE-2026-76581 in WPMU DEV Dashboard allows authentication bypass and administrator access on sites with Hub SSO enabled and mapped to an administrator.
CVE-2026-18431 in the Avada theme enables arbitrary file write and remote code execution when the Fusion Builder plugin is active.
CVE-2026-19632 in TranslatePress exposes the administrator password-reset URL, including the plaintext reset key, under specific settings.
CVE-2026-19598 in Pods allows unauthenticated privilege escalation to Administrator or password overwrite for any user account.

Vulnerability Details

Wordfence and Patchstack disclosed the five flaws, all rated critical with CVSS scores of 9.8 or 10.0. CVE-2026-76581 affects WPMU DEV Dashboard versions up to 5.0.1 and requires Hub SSO enabled and mapped to an administrator. CVE-2026-18431 affects Avada theme versions up to 7.16 when Fusion Builder plugin versions up to 3.16 are installed and active. CVE-2026-19632 affects TranslatePress versions up to 3.3.1 only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language. CVE-2026-19598 affects Pods versions up to 3.3.9, allowing unauthenticated privilege escalation or password overwrite.

GiveWP Remote Code Execution

CVE-2026-82222 affects GiveWP versions up to 4.16.7.1 and requires one published donation form and one active payment gateway. Patchstack explained that the flaw chains a broken 'safe unserialize' helper, a donation flow that feeds attacker-controlled data, and a gadget chain in code that GiveWP ships. The vulnerability demonstrates how PHP object injection turns into remote code execution when three ingredients align: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes.

1 source

WordPress Plugins and Themes Expose Five Critical Flaws Enabling Site Takeover

thehackernews.com

The Hacker News

Technology

Vercel patches two critical Next.js flaws enabling unauthenticated remote code execution

Vercel released security patches for two critical vulnerabilities in the Next.js web framework on August 25, 2026. Both flaws allow unauthenticated remote code execution, one via crafted AVIF images and the other through a Windows path traversal. The fixes are available in Next.js 15.5.24 and 16.3.3.

Technology

Zoom patches memory corruption flaws enabling zero-click remote code execution

Zoom patches memory corruption flaws in its annotation feature that allowed malicious meeting participants to execute code remotely without clicks or downloads. The vulnerabilities affect all Zoom Workplace versions before July 20 across platforms, including mobile; security experts recommend installing the patch, warning endpoint software cannot reliably block these attacks. Zoom's server-side mitigations will not protect users who have enabled end-to-end encryption.

Technology

Critical isolated-vm flaw enables remote code execution on host

A critical type confusion vulnerability in the isolated-vm Node.js library allows remote code execution on the host system. The flaw, which lacks a CVE identifier, affects ExternalCopy, the function used to copy data across Isolates. Patches are available in isolated-vm versions 6.2.0 and 7.0.1.

Technology

Wordfence discloses 9.8-rated Forminator flaw with 600,000 installations allowing remote code execution

Wordfence discloses a critical flaw, CVE-2026-15748, in the Forminator Forms WordPress plugin, installed on more than 600,000 sites, that allows unauthenticated attackers to upload PHP files and execute code. The vulnerability is fixed in version 1.56.2 released July 31, 2026, but exploitation requires a form with both a File Upload and a Select field. Wordfence also discloses a separate 9.8-rated authentication bypass in User Profile Builder, patched July 16, 2026, affecting more than 40,000 installations.

WordPress Plugins and Themes Expose Five Critical Flaws Enabling Site Takeover

Key Facts

Vulnerability Details

GiveWP Remote Code Execution

Read more

Read more