Five Critical WordPress Vulnerabilities Threaten Site Takeover and RCE
Multiple popular WordPress plugins and themes harbor critical vulnerabilities, including authentication bypass, privilege escalation, and remote code execution flaws, potentially impacting hundreds of thousands of sites.
Security researchers have disclosed five critical vulnerabilities affecting widely-used WordPress plugins and themes, posing a significant risk of site takeover, account compromise, and arbitrary code execution for website administrators and owners. The vulnerabilities were detailed by security firms Wordfence and Patchstack, highlighting the persistent security challenges within the vast WordPress ecosystem.
The most severe of these flaws is CVE-2026-82222, a 10.0 CVSS-rated vulnerability in the GiveWP plugin. This flaw allows an attacker to execute arbitrary commands on a server if the site has at least one active donation form and one active payment gateway. Patchstack explained that the vulnerability chains a flawed "safe unserialize" helper, a donation flow that accepts attacker-controlled data, and a gadget chain within the plugin's code, ultimately leading to remote code execution through PHP object injection.
Another critical vulnerability, CVE-2026-76581 with a CVSS score of 9.8, affects the WPMU DEV Dashboard plugin. This authentication bypass flaw could enable an unauthenticated attacker to gain administrator access on sites using the Hub Single-Sign On (SSO) feature, leading to a complete site takeover. The vulnerability specifically targets sites where SSO is enabled and mapped to an administrator account.
The Avada theme, a popular choice for WordPress users, is also impacted by a critical vulnerability, CVE-2026-18431 (CVSS 9.8). This flaw allows an unauthenticated attacker to write arbitrary files to the server, which can then be exploited to create and execute malicious PHP files, resulting in remote code execution and full site compromise. This vulnerability is present when the Fusion Builder plugin is installed and active.
Furthermore, the "TranslatePress – Translate Multilingual sites with AI Translation" plugin suffers from CVE-2026-19632 (CVSS 9.8), a sensitive information exposure flaw. An unauthenticated attacker can exploit this to obtain the raw administrator password-reset URL, including the plaintext reset key, enabling them to take over administrator accounts. This exploit is possible under specific conditions, including when automatic string saving is enabled and the target administrator's locale is set to a published secondary language.
Finally, the "Pods – Custom Content Types and Fields" plugin has a privilege escalation vulnerability, CVE-2026-19598 (CVSS 9.8). This flaw allows an unauthenticated attacker to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner, leading to complete site takeover. The vulnerability affects all versions of the plugin up to 3.3.9.
These disclosures underscore the ongoing need for vigilance in the WordPress community. With millions of websites relying on plugins and themes, even a single critical vulnerability can have widespread consequences. Users are strongly advised to update the affected plugins and themes to their latest patched versions immediately to mitigate these risks. The common root causes cited by researchers—trusting serialization sanitizers, unserializing untrusted data, and shipping development libraries into production—highlight systemic issues that developers must address to improve the overall security posture of the WordPress ecosystem.