VYPR
Vypr IntelligenceAI-generatedAug 26, 2026· 25 CVEs

WordPress: 25 Plugins and Themes Hit by Vulnerabilities, Including Critical RCE and File Upload Flaws

A batch of 25 WordPress plugin and theme vulnerabilities, including critical flaws like RCE and file upload, were disclosed on August 26, 2026.

Key findings

  • 25 WordPress plugins and themes had vulnerabilities disclosed on August 26, 2026.
  • Critical RCE in Avada theme (CVE-2026-18431) and unrestricted file upload in ERP plugin (CVE-2026-18080) are among the most severe.
  • Multiple Stored XSS, Authentication Bypass, and File Manipulation flaws affect various plugins.
  • Directory Traversal in Formidable Charts (CVE-2026-15990) and SQL Injection in WooCommerce Lottery (CVE-2026-18884) also disclosed.
  • Users urged to update affected plugins and themes immediately to patch these vulnerabilities.

On August 26, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins and themes, with a notable critical Remote Code Execution (RCE) vulnerability in the popular Avada theme. The disclosures, occurring within an 8-hour window, highlight ongoing security challenges within the WordPress ecosystem. The vulnerabilities range in severity from medium to critical, impacting a wide array of functionalities including file uploads, directory traversal, cross-site scripting, authentication bypass, and SQL injection.

Several vulnerabilities fall into common categories:

Stored Cross-Site Scripting (XSS)

Multiple plugins were found to be vulnerable to Stored XSS, allowing authenticated attackers to inject malicious scripts into websites.

  • The Greenshift plugin (versions up to 12.8.9) is affected via its customapi action handler due to insufficient sanitization of API responses. CVE-2026-5092.
  • The Reviews and Rating – Google Reviews plugin (versions up to 5.10) is vulnerable through its wp_display() shortcode handler, allowing HTML tag injection. CVE-2026-2388.
  • The Betheme theme (versions up to 28.4) contains an XSS flaw in its icon_box_2 shortcode due to improper sanitization of user-supplied attributes. CVE-2026-6178.
  • The Gutenverse plugin (versions up to 4.0.2) suffers from XSS in multiple blocks due to insufficient input sanitization. CVE-2026-3002.
  • The Formidable Forms plugin (versions up to 6.33.1) has an XSS vulnerability via the frm_user_id parameter. CVE-2026-18331.

Authentication and Authorization Bypass

A number of vulnerabilities allow attackers to bypass authentication or authorization mechanisms, gaining unauthorized access to sensitive data or functionality.

  • The Classified Listing – Mobile Number Verification plugin (versions up to 1.6.0) has an authentication bypass due to missing server-side OTP validation. CVE-2026-15985.
  • The Mang Board WP plugin (versions up to 2.3.7) is vulnerable to authentication cookie forgery due to flawed HMAC generation. CVE-2026-75977.
  • The WP Data Access plugin (versions up to 5.5.68) suffers from an Insecure Direct Object Reference (IDOR) in the check_app_access function, allowing unauthenticated access to protected data. CVE-2026-3235.
  • The Simple Newsletter Plugin (versions before 4.3.3) allows unauthenticated users to disclose subscriber data due to insufficient verification of requester identity. CVE-2026-78146.
  • The Stripe Payment Forms by WP Full Pay plugin (versions before 8.5.1) has flaws allowing users to manage subscriptions belonging to others or view sensitive subscription data without proper verification. CVE-2026-77789, CVE-2026-77758.
  • The Kirki plugin (versions before 6.0.14) has improper capability checks on AJAX actions, enabling unauthenticated users to retrieve user emails and other sensitive information. CVE-2026-77754.
  • The Project Manager plugin (versions before 4.0.7) has REST API routes that do not properly restrict access, allowing authenticated users to view or modify other users' activity and project data. CVE-2026-74930, CVE-2026-74929.

File Manipulation and Information Disclosure

Several vulnerabilities involve the manipulation of files or the disclosure of sensitive information.

  • The Formidable Charts plugin (versions up to 2.0.1) is vulnerable to Directory Traversal via the frm_graph parameter, allowing attackers to read arbitrary files. CVE-2026-15990.
  • The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin (versions up to 1.17.8) has an Unrestricted File Type Upload vulnerability in the save_attachments() function. CVE-2026-18080.
  • The Directorist plugin (versions before 8.9.3) allows users to relocate arbitrary server-readable image files due to insufficient sanitization of image references. CVE-2026-77757.
  • The AI Engine plugin (versions before 3.7.2) allows subscribers to read arbitrary files from the server and exfiltrate them to an external service. CVE-2026-75797.

Critical Vulnerabilities and Exploitation

The most severe vulnerability disclosed is CVE-2026-18431, a critical Arbitrary File Write in the Avada theme (versions up to 7.16) when used with the Fusion Builder plugin (versions up to 3.16). This vulnerability, detailed in a Wordfence report, arises from a chain of authorization and input validation weaknesses. While this specific CVE is not explicitly stated as being exploited in the wild in the provided information, the Wordfence report highlights their AI-assisted research capabilities in discovering such complex vulnerabilities.

Another critical vulnerability, CVE-2026-18080, affects the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin, allowing unrestricted file uploads.

Additionally, CVE-2026-18884, a High severity Time-Based SQL Injection in the WooCommerce Lottery plugin (versions up to 2.2.9), and CVE-2026-77693, a High severity arbitrary file deletion vulnerability in the Order Tip for WooCommerce plugin (versions before 1.6.0), pose significant risks.

Other Notable Vulnerabilities

  • The WooCommerce Lottery plugin (versions up to 2.2.9) is vulnerable to Time-Based SQL Injection. CVE-2026-18884.
  • The Order Tip for WooCommerce plugin (versions before 1.6.0) allows users with Shop Manager roles to delete arbitrary files on the server. CVE-2026-77693.
  • The AI Engine plugin (versions before 3.7.2) allows unauthenticated attackers to run arbitrary AI queries against the site owner's configured provider account. CVE-2026-75798.
  • The Eventin plugin (versions before 4.1.19) allows unauthenticated users to mark unpaid orders as completed and receive valid tickets without payment. CVE-2026-77694.

Users of affected WordPress plugins and themes are strongly advised to update to the patched versions immediately. The widespread nature of these vulnerabilities underscores the importance of diligent security practices, including regular updates and security audits, for WordPress site administrators. The disclosure of a critical RCE in a widely used theme like Avada, coupled with numerous other high and medium severity flaws, indicates a continued need for vigilance in the WordPress security landscape.

The batch of vulnerabilities was disclosed on August 26, 2026. The critical CVE-2026-18431 in the Avada theme was also the subject of a detailed report by Wordfence on August 25, 2026, highlighting the rapid pace of vulnerability discovery and disclosure. Patches for most of these vulnerabilities are available in the respective plugin and theme updates.

The sheer volume and variety of these vulnerabilities, ranging from authentication bypasses to critical RCE and file manipulation, emphasize the complex threat surface presented by the WordPress ecosystem. Administrators must prioritize updating all plugins and themes to their latest versions to mitigate these risks. The disclosure event serves as a stark reminder of the continuous need for robust security measures in managing WordPress websites.

AI-written article. Grounded in 25 CVE records listed below.