Full research report

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The evidence supports five high-impact but unrelated WordPress disclosures rather than a shared campaign. All five have unauthenticated paths, but exposure is configuration-dependent for WPMU DEV Dashboard, TranslatePress and GiveWP, while Avada requires the paired vulnerable Fusion Builder component. The strongest code-execution findings are the Avada multi-stage arbitrary-file-write chain and GiveWP's PHP object injection, whereas the other flaws primarily reach site takeover through administrator authentication or authorisation failures. Fixed releases were available before the 29 August roundup, so patch verification and compromise review are now more important than relying only on preventive filtering.

What happened

Between 10 and 28 August 2026, researchers disclosed five separate critical WordPress weaknesses affecting WPMU DEV Dashboard, Avada with Fusion Builder, TranslatePress, Pods and GiveWP. The Hacker News grouped them on 29 August, but the evidence supports a vulnerability roundup rather than a single campaign or coordinated intrusion set. Depending on the product and configuration, successful attacks could produce administrator access, account takeover, arbitrary PHP execution or server command execution.

Affected scope

WPMU DEV Dashboard versions through 5.0.1 are affected when the site is connected to WPMU DEV and Hub SSO is enabled and mapped to an administrator; version 5.0.2 fixes the issue. Avada through 7.16 with Fusion Builder through 3.16 is affected and should be updated to 7.16.1 and 3.16.1 respectively. TranslatePress through 3.3.1 is affected when automatic string saving is enabled and the administrator uses a published secondary-language locale; 3.3.2 is fixed. Pods has vulnerable branches through 3.3.9, with fixes in 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3 and 3.3.9.1. GiveWP through 4.16.7.1 is affected; reachability varies by form type and version, and 4.16.7.2 contains the fix.

Technical assessment

The flaws are technically unrelated. WPMU DEV Dashboard inconsistently constructs and verifies a Hash-based Message Authentication Code (HMAC) across its single sign-on flow; Avada chains several weaknesses into an arbitrary file write and PHP execution; TranslatePress can store and expose an administrator password-reset URL in a translation table; and Pods can continue routing administrative requests after failed authorisation checks. GiveWP accepts attacker-controlled donation data that later reaches unsafe PHP deserialisation while suitable classes are loaded, enabling object injection to become remote code execution.

Recommended defensive actions

  1. Inventory all WordPress instances for the five affected products, including inactive copies and bundled Fusion Builder installations.
  2. Patch WPMU DEV Dashboard to 5.0.2, Avada to 7.16.1 with Fusion Builder 3.16.1, TranslatePress to 3.3.2, Pods to the fixed release for its installed branch, and GiveWP to 4.16.7.2 or later.
  3. Disable WPMU DEV Hub SSO until 5.0.2 is installed where immediate updating is impossible.
  4. Verify TranslatePress administrator locale settings and automatic string-saving configuration, then invalidate outstanding administrator password-reset links and review recent password changes.
  5. Hunt for unexpected administrator sessions or accounts, unauthorised password changes, modified plugin or theme PHP files, suspicious donation submissions and anomalous requests to the affected public AJAX routes.
  6. Review web, authentication, PHP and WordPress audit logs from at least 10 August 2026 onward, and isolate any site showing unexplained administrative or file-system changes.
  7. Restrict direct administrative access, disable the built-in plugin and theme file editors where operationally feasible, and deploy web-application firewall protections as compensating controls rather than substitutes for patching.

Uncertainties and evidence gaps

  • No reviewed source confirmed exploitation in the wild, but absence of published reporting does not prove that exploitation has not occurred.
  • No public standalone exploit repository was verified; Wordfence states that it produced a working Avada PoC privately, while Patchstack published substantial GiveWP technical detail.
  • Published installation or sales counts do not establish how many deployed sites meet the configuration prerequisites for exploitation.
  • Wordfence could confirm tested Avada versions but noted that the precise earliest affected premium release was not established from every historical build.
  • The supplied reporting identifies CVE-2026-76581, but the reviewed sources did not establish its distinct role in this event.
  • The supplied reporting identifies CVE-2026-18431, but the reviewed sources did not establish its distinct role in this event.
  • The supplied reporting identifies CVE-2026-19598, but the reviewed sources did not establish its distinct role in this event.
  • The supplied reporting identifies CVE-2026-19632, but the reviewed sources did not establish its distinct role in this event.
  • The supplied reporting identifies CVE-2026-82222, but the reviewed sources did not establish its distinct role in this event.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessThe reported paths are unauthenticated, although exploitation depends on product-specific exposure and configuration prerequisites such as Hub SSO, a qualifying language configuration, Avada with Fusion Builder, or a reachable GiveWP donation form and gateway.
ComponentWordPress SSO and AJAX handlers, theme and page-builder file operations, translation dictionaries, administrative request routing, and GiveWP donation-data deserialisation.
MechanismImproper cryptographic verification, a multi-stage arbitrary-file-write chain, sensitive reset-link disclosure, failure to terminate after authorisation errors, or unsafe PHP object deserialisation.
ImpactAdministrator session creation, account takeover, arbitrary PHP execution, remote command execution and complete compromise of the WordPress site or hosting account within the web process's privileges.
DetectionLook for unexpected administrator sessions and password changes, new privileged users, altered PHP files, anomalous requests to affected AJAX or SSO routes, suspicious donation submissions, and unexplained commands or child processes originating from the web server.
MitigationInstall WPMU DEV Dashboard 5.0.2, Avada 7.16.1 and Fusion Builder 3.16.1, TranslatePress 3.3.2, an appropriate fixed Pods branch release, and GiveWP 4.16.7.2 or later; disable Hub SSO until patched where necessary.
Exploitation status

No confirmed active exploitation was found; researchers privately demonstrated exploitability, including a working Avada PoC, and public technical write-ups exist, but no public standalone exploit code was verified.

Research process

The investigation first tested whether the headline described a common campaign or a collection of independent disclosures. Reading the underlying Wordfence and Patchstack publications confirmed five distinct vulnerabilities, their configuration prerequisites and fixed releases, while the NVD record independently confirmed the WPMU DEV CVE details. No reviewed publication established exploitation in the wild, and a CISA Known Exploited Vulnerabilities search returned no GiveWP entry at the time reviewed.

  1. Does the supplied story describe one campaign or multiple vulnerability disclosures?
    Opened and assessed the supplied article against its linked source material.
    thehackernews.com ↗

    The article groups five unrelated WordPress flaws disclosed by Wordfence and Patchstack on different dates.

    why This prevented the roundup from being mischaracterised as a coordinated campaign or common attack chain.

  2. What exactly is vulnerable in WPMU DEV Dashboard, and what fixes it?
    Read the primary Wordfence disclosure and its affected-version, technical and disclosure sections.
    wordfence.com ↗

    CVE-2026-76581 affects versions through 5.0.1 on connected sites with Hub SSO enabled and can create an administrator session; 5.0.2 was released on 24 August 2026.

    why The configuration dependency narrows exposure, while unauthenticated administrator access justifies urgent remediation.

  3. Is the Avada issue genuinely remote code execution, and is exploit code public?
    Read the primary Avada disclosure, version summary and patch timeline.
    wordfence.com ↗

    CVE-2026-18431 chains six weaknesses into unauthenticated arbitrary PHP execution when vulnerable Avada and Fusion Builder versions are combined; Wordfence produced a working PoC but did not publish it, and fixes shipped in 7.16.1 and 3.16.1.

    why This confirms technical exploitability without supporting a claim that public exploit code or attacks in the wild exist.

  4. Under what conditions does TranslatePress permit account takeover?
    Reviewed the primary disclosure, affected configuration and fixed-version information.
    wordfence.com ↗

    CVE-2026-19632 can expose a raw administrator password-reset URL when automatic string saving is active and the administrator uses a published secondary-language locale; version 3.3.2 fixes it.

    why The prerequisite materially reduces the vulnerable population but does not reduce the consequence for qualifying sites.

  5. How does Pods bypass its intended administrative controls?
    Reviewed the primary Pods disclosure and its supported-branch patch information.
    wordfence.com ↗

    CVE-2026-19598 arises because failed checks can log and return without terminating the public administrative request, permitting privileged operations; fixes were issued for six release branches.

    why The finding supports account-takeover impact and shows that defenders must select the correct fixed release for their installed branch.

  6. What makes the GiveWP flaw reachable and what version breaks the chain?
    Read Patchstack's primary technical analysis, patch section and timeline.
    patchstack.com ↗

    CVE-2026-82222 combines attacker-controlled donation data, unsafe deserialisation and loaded classes into command execution. Reachability differs across releases, and GiveWP 4.16.7.2 breaks the chain at several points.

    why This confirms unauthenticated remote code execution while avoiding the inaccurate claim that every vulnerable release is reachable under an identical default configuration.

  7. Does an independent government record corroborate the WPMU DEV CVE and scope?
    Opened the National Vulnerability Database record.
    nvd.nist.gov ↗

    NVD records CVE-2026-76581 against WPMU DEV Dashboard through 5.0.1, describes the HMAC verification weakness and attributes the record to Wordfence; NVD had not independently scored it.

    why This independently confirms the identifier and affected product while preserving the distinction between the CVE Numbering Authority's score and an NVD assessment.

  8. Is there government confirmation that GiveWP is being exploited in the wild?
    Searched the CISA Known Exploited Vulnerabilities catalogue for CVE-2026-82222.
    cisa.gov ↗

    The filtered catalogue returned no entry for CVE-2026-82222 at the time reviewed.

    why This provides no government confirmation of active exploitation, although catalogue absence alone cannot prove that exploitation has not occurred.

Named in this story
TargetsWordPress site operatorsSites using WPMU DEV Dashboard with Hub SSO enabledSites using Avada with Fusion BuilderMultilingual sites using TranslatePressSites using Pods custom-content functionalityCharities and other organisations using GiveWP donation forms
Related CVEs CVE-2026-76581CVE-2026-18431CVE-2026-19598CVE-2026-19632CVE-2026-82222

Research coverage

All 73 registered source leaves were evaluated for this run: 65 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 61 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok1 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
CISA KEVkev ok1685 records Corroborating1 matched items A page from this source was opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1013 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok8067 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok6 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 11 opened outside the registered collection
References & evidence
PoC & exploit code2
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales wordfence.com ↗

Wordfence reports creating a working private PoC for the six-stage Avada chain but does not publish the exploit.

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP patchstack.com ↗

Detailed public technical analysis of the GiveWP object-injection chain and its layered fix.

Vendor & gov advisories6
NVD CVE-2026-76581 Detail nvd.nist.gov ↗

US government record confirming the WPMU DEV Dashboard flaw, affected versions and CVE assignment.

Critical Authentication Bypass in WPMU DEV Dashboard Plugin wordfence.com ↗

Primary disclosure identifying WPMU DEV Dashboard 5.0.2 as the fixed release.

Critical RCE in Avada Theme wordfence.com ↗

Primary disclosure identifying Avada 7.16.1 and Fusion Builder 3.16.1 as fixed.

Account Takeover Vulnerability in TranslatePress wordfence.com ↗

Primary disclosure documenting the conditional password-reset-link exposure fixed in 3.3.2.

Privilege Escalation Vulnerability in Pods wordfence.com ↗

Primary disclosure listing fixed releases for every supported Pods branch.

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP patchstack.com ↗

Primary disclosure documenting CVE-2026-82222 and the fix in GiveWP 4.16.7.2.

Analysis & research1
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE thehackernews.com ↗

Independent reporting that grouped five separate August 2026 disclosures; it does not establish a common campaign.