Several critical security vulnerabilities have been uncovered in WordPress plugins and themes such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These vulnerabilities pose risks of authentication bypass, account takeover, and arbitrary code execution.
The security flaws, as reported by Wordfence and Patchstack, are detailed below:
- CVE-2026-76581 (CVSS score: 9.8) – Authentication bypass vulnerability in the WPMU DEV Dashboard plugin, enabling unauthorized access to administrator privileges and potential site takeover.
- CVE-2026-18431 (CVSS score: 9.8) – Arbitrary file write flaw in the Avada theme allowing remote code execution and site compromise.
- CVE-2026-19632 (CVSS score: 9.8) – Sensitive information exposure in the TranslatePress plugin leading to administrator account takeover.
- CVE-2026-19598 (CVSS score: 9.8) – Privilege escalation flaw in the Pods plugin allowing unauthorized users to gain administrator privileges.
- CVE-2026-82222 (CVSS score: 10.0) – Vulnerability in the GiveWP plugin enabling execution of arbitrary commands on the server.
Patchstack commented on CVE-2026-82222, stating, “This case demonstrates how PHP object injection can lead to remote code execution when certain conditions align, including a place for storing attacker-controlled serialized objects and a gadget chain in loaded classes.”
“The underlying causes are typical: reliance on a serialization sanitizer that fails to remove objects, treating unserialized data from the database as trusted, and including development libraries in production environments where they introduce potential gadget chains.”
