Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP — Threadlinqs Intelligence
As of 2026-08-31, Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-2210 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-31 · revalidated 1× · latest source
Five unrelated CVSS 9.8-10.0 vulnerabilities disclosed within a two-week window across widely-installed WordPress plugins and themes (WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods,
On 2026-08-29, The Hacker News published a consolidated roundup of five critical, independently-discovered vulnerabilities disclosed across popular WordPress plugins and themes between 2026-08-13 and 2026-08-28. Despite the shared publication window, the five CVEs are unrelated supply-chain findings in separate codebases with no evidence of a common threat actor or coordinated campaign; the grouping reflects a disclosure cluster, not a single exploit chain.
CVE-2026-76581 (CVSS 9.8, CWE-347) affects the WPMU DEV Dashboard plugin (<=5.0.1, ~350,000 installs). Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, found that the plugin's Hub Single Sign-On (SSO) handshake constructs and validates HMAC-SHA-256 signatures inconsistently: an unauthenticated first-stage endpoint acts as a signing oracle whose valid HMAC output can be replayed in a different logical context, letting an unauthenticated attacker obtain administrator access on any site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator. Fixed in 5.0.2 (2026-08-24).
CVE-2026-18431 (CVSS 9.8, CWE-862) affects the Avada theme (<=7.16, 1M+ sales) when the bundled Fusion Builder plugin (<=3.16) is active. Wordfence chained six separate authorization and input-validation weaknesses spanning both components -- from exposing attacker-controlled input through a public request, to invoking a privileged component out of context, to bypassing file-handling restrictions -- into a single unauthenticated, zero-click attack that writes attacker-controlled files to the server. Those files can then be used to create and execute arbitrary PHP, yielding full remote code execution and site compromise. Fixed in Avada 7.16.1 / Fusion Builder 3.16.1 (2026-08-26).
CVE-2026-19632 (CVSS 9.8, CWE-640) affects TranslatePress (<=3.3.1, 400,000+ installs) via the unauthenticated 'trp_get_translations_regular' AJAX action. When automatic string saving is enabled and an administrator's profile language is set to a published secondary language, the plugin's password-reset email link -- including the plaintext reset key -- gets written into the plugin's translation dictionary table, from which any unauthenticated visitor can retrieve it via the AJAX action and take over the administrator account. Reported by researcher momopon1415 through the Wordfence Bug Bounty Program (rewarded $975); fixed in 3.3.2 (2026-08-13).
CVE-2026-19598 (CVSS 9.8, CWE-863) affects Pods - Custom Content Types and Fields (<=3.3.9, 100,000+ installs). The pods_admin AJAX router funnels every access check -- method allowlist, nonce verification, login enforcement, and capability gate -- through the pods_error() function, which under the JSON meta-box-loader compatibility code path only writes the failure to the PHP error log and returns false instead of terminating the request, rendering every guard ineffective. This lets an unauthenticated attacker escalate to Administrator or overwrite any user's password, including the site owner's. A public Python proof-of-concept (DeadExpl0it/CVE-2026-19598-PoC on GitHub) demonstrating the exploit is already available, despite initial reporting that no PoC existed. Fixed across branches: 3.3.9.1, 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4.
CVE-2026-82222 (CVSS 10.0, CWE-502) affects GiveWP (<=4.16.7.1, 100,000+ installs). Researcher Udin Chan (reported to Patchstack 2026-07-28) found that GiveWP's safeUnserialize() helper (src/Helpers/Utils.php) calls PHP's unserialize() with allowed_classes=>false, which converts injected objects into __PHP_Incomplete_Class placeholders rather than neutralizing them; on re-serialization the original attacker bytes are written back out intact. The donation-processing flow (includes/process-donation.php) passes user-controlled account metadata such as last_name through this helper via array_map() and persists it, unsanitized, in the wp_give_sessions table. A later, unguarded read of that stored pay
Weaknesses (CWE)
CWE-347, CWE-862, CWE-640, CWE-863, CWE-502
Target sectors: nonprofit, technology, government administration, financial-services, health, education, news - media, ecommerce, professional-services
Target regions: Global
Timeline
- Researcher Udin Chan reports the GiveWP PHP object-injection/RCE flaw to Patchstack; CVE-2026-82222 is assigned.
- Cozmoslabs releases TranslatePress 3.3.2, fixing the CVE-2026-19632 password-reset-URL exposure; researcher momopon1415 is credited a $975 Wordfence Bug Bounty reward.
- CVE-2026-19598 (Pods pods_admin authorization-bypass privilege escalation) is published/assigned by Wordfence.
- Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, discovers the WPMU DEV Dashboard Hub SSO HMAC canonicalization-confusion authentication bypass (CVE-2026-76581).
- WPMU DEV releases Dashboard plugin version 5.0.2, fixing CVE-2026-76581.
- Wordfence deploys a Premium/Care/Response-tier firewall rule protecting customers against CVE-2026-76581 exploitation attempts.
- ThemeFusion releases Avada 7.16.1 and Fusion Builder 3.16.1, fixing the six-step unauthenticated arbitrary-file-write chain tracked as CVE-2026-18431.
- GiveWP (StellarWP/Liquid Web) releases version 4.16.7.2 with five layered mitigations for the CVE-2026-82222 PHP object-injection/RCE gadget chain.
- CVE-2026-76581, CVE-2026-18431, and CVE-2026-82222 are formally published across Wordfence and Patchstack advisories and NVD records.
- The Hacker News publishes a consolidated roundup covering all five critical WordPress plugin/theme vulnerabilities, prompting TL-Intel Harness ingestion.
- Wordfence free-tier users are scheduled to receive the CVE-2026-76581 firewall rule, 30 days after the Premium rollout.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, CVE-2026-82222, T1190, T1199, T1550.001, T1098, T1212, T1213, T1505.003, T1059.004, T1068, T1136
