Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP

Key facts for Five WordPress plugins CVSS 10.0

Detection coverage for Five WordPress plugins CVSS 10.0

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2210 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster)

Detects unauthenticated or pre-auth HTTP requests to the specific AJAX/REST/form endpoints abused by the five 2026-08 critical WordPress plugin/theme CVEs: TranslatePress's trp_get_translations_regular AJAX action (CVE-2026-19632), Pods' pods_admin AJAX router (CVE-2026-19598), WPMU DEV Dashboard's Hub SSO handshake endpoint (CVE-2026-76581), Fusion Builder POST handlers bundled with Avada (CVE-2026-18431), and GiveWP donation submissions to the default manual/offline gateways (CVE-2026-82222). A successful (2xx/403) hit on any of these endpoints from an anonymous session is the initial-access trigger for full site takeover or RCE.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1199, T1550.001
• Data sources: apache_access, nginx_access, azure_app_service_http_logs, iis_w3c_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web (sourcetype=apache_access OR sourcetype=nginx_access OR sourcetype=wordpress:access)
| eval vuln_endpoint=case(
    like(uri_query, "%action=trp_get_translations_regular%"), "translatepress_cve_2026_19632",
    like(uri_path, "%/wp-admin/admin-ajax.php%") AND like(uri_query, "%action=pods_admin%"), "pods_cve_2026_19598",
    like(uri_path, "%/wp-json/wpmudev%") OR like(uri_path, "%/wp-content/plugins/wpmudev-updates/%"), "wpmudev_hub_sso_cve_2026_76581",
    like(uri_path, "%fusion-builder%") AND method="POST", "avada_fusion_cve_2026_18431",
    (like(uri_path, "%/wp-json/give-api%") OR (like(uri_path, "%/?give_action=%"))) AND (like(uri_query, "%gateway=manual%") OR like(uri_query, "%gateway=offline%")), "givewp_cve_2026_82222")
| where isnotnull(vuln_endpoint)
| where status<300 OR status=403
| eval is_authenticated=if(match(cookie, "wordpress_logged_in"), 1, 0)
| where is_authenticated=0
| stats count as hit_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(uri_path) as paths, values(http_user_agent) as user_agents by src_ip, vuln_endpoint
| where hit_count>=1
| sort -hit_count

Microsoft KQL

let VulnEndpoints = AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category in ("AppServiceHTTPLogs", "IISLog")
| extend UriPath = tostring(cs_uri_stem_s), UriQuery = tostring(cs_uri_query_s), Method = tostring(sc_method_s), Status = toint(sc_status_s), ClientIP = tostring(c_ip_s), UA = tostring(cs_User_Agent_s), Cookie = tostring(cs_Cookie_s)
| extend VulnEndpoint = case(
    UriQuery has "action=trp_get_translations_regular", "translatepress_cve_2026_19632",
    UriPath has "admin-ajax.php" and UriQuery has "action=pods_admin", "pods_cve_2026_19598",
    UriPath has "wp-json/wpmudev" or UriPath has "wpmudev-updates", "wpmudev_hub_sso_cve_2026_76581",
    UriPath has "fusion-builder" and Method == "POST", "avada_fusion_cve_2026_18431",
    (UriPath has "give-api" or UriPath has "give_action") and (UriQuery has "gateway=manual" or UriQuery has "gateway=offline"), "givewp_cve_2026_82222",
    "")
| where VulnEndpoint != ""
| where Status < 300 or Status == 403
| where Cookie !has "wordpress_logged_in";
VulnEndpoints
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(UriPath), UserAgents = make_set(UA) by ClientIP, VulnEndpoint
| sort by HitCount desc

Sigma

title: Unauthenticated Access to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster Aug 2026)
id: 7a2c1e4f-3b9d-4a71-9e2c-1f6a8d0b5c31
status: experimental
description: Detects anonymous HTTP requests to the specific vulnerable endpoints for CVE-2026-76581 (WPMU DEV Dashboard), CVE-2026-18431 (Avada/Fusion Builder), CVE-2026-19632 (TranslatePress), CVE-2026-19598 (Pods), and CVE-2026-82222 (GiveWP).
references:
    - https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpmudev-updates/wpmu-dev-dashboard-501-authentication-bypass-to-administrator-via-sso-hmac-canonicalization-confusion
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1199
    - attack.t1550.001
    - cve.2026.76581
    - cve.2026.18431
    - cve.2026.19632
    - cve.2026.19598
    - cve.2026.82222
logsource:
    category: webserver
detection:
    selection_translatepress:
        cs-uri-query|contains: 'action=trp_get_translations_regular'
    selection_pods:
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pods_admin'
    selection_wpmudev:
        c-uri|contains:
            - '/wp-json/wpmudev'
            - '/wp-content/plugins/wpmudev-updates/'
    selection_avada:
        c-uri|contains: 'fusion-builder'
        cs-method: 'POST'
    selection_givewp:
        c-uri|contains:
            - '/wp-json/give-api'
            - 'give_action='
        cs-uri-query|contains:
            - 'gateway=manual'
            - 'gateway=offline'
    filter_authenticated:
        cs-cookie|contains: 'wordpress_logged_in'
    condition: (selection_translatepress or selection_pods or selection_wpmudev or selection_avada or selection_givewp) and not filter_authenticated
falsepositives:
    - Legitimate anonymous visitors submitting a donation form through GiveWP's default gateways
    - Automated uptime/health-check bots crawling admin-ajax.php for unrelated plugin actions
level: high

Known false positives:

• Legitimate anonymous donors submitting a GiveWP donation through the manual/offline gateway
• Third-party translation-management crawlers hitting admin-ajax.php with unrelated actions
• Uptime/health-check monitors probing wp-json REST discovery routes

Tuning notes: Baseline legitimate GiveWP donation volume per site before enabling alerting on the givewp_cve_2026_82222 bucket; exclude known WPScan/uptime-monitor source IPs; if the site does not use WPMU DEV Hub SSO, treat any hit on that endpoint as high-confidence malicious with no tuning needed.

• 🔒 Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster) · unlock with TL Creds
• 🔒 Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration · unlock with TL Creds
• 🔒 OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) · unlock with TL Creds
• 🔒 Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster) · unlock with TL Creds
• 🔒 Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration · unlock with TL Creds
• 🔒 OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) · unlock with TL Creds
• 🔒 Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration · unlock with TL Creds
• 🔒 OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) · unlock with TL Creds

Indicators of compromise for Five WordPress plugins CVSS 10.0

As of 2026-08-31, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2210.

Sample indicators (1 of 24)

• URL: hxxps://github[.]com/DeadExpl0it/CVE-2026-19598-PoC

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How Five WordPress plugins CVSS 10.0 works

All five vendors shipped fixes before or around public disclosure, and a public proof-of-concept exploit for one of the five (Pods, CVE-2026-19598) is already circulating on GitHub, contradicting the initial no-PoC assessment.

On 2026-08-29, The Hacker News published a consolidated roundup of five critical, independently-discovered vulnerabilities disclosed across popular WordPress plugins and themes between 2026-08-13 and 2026-08-28. Despite the shared publication window, the five CVEs are unrelated supply-chain findings in separate codebases with no evidence of a common threat actor or coordinated campaign; the grouping reflects a disclosure cluster, not a single exploit chain.

CVE-2026-76581 (CVSS 9.8, CWE-347) affects the WPMU DEV Dashboard plugin (<=5.0.1, ~350,000 installs). Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, found that the plugin's Hub Single Sign-On (SSO) handshake constructs and validates HMAC-SHA-256 signatures inconsistently: an unauthenticated first-stage endpoint acts as a signing oracle whose valid HMAC output can be replayed in a different logical context, letting an unauthenticated attacker obtain administrator access on any site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator. Fixed in 5.0.2 (2026-08-24).

CVE-2026-18431 (CVSS 9.8, CWE-862) affects the Avada theme (<=7.16, 1M+ sales) when the bundled Fusion Builder plugin (<=3.16) is active. Wordfence chained six separate authorization and input-validation weaknesses spanning both components -- from exposing attacker-controlled input through a public request, to invoking a privileged component out of context, to bypassing file-handling restrictions -- into a single unauthenticated, zero-click attack that writes attacker-controlled files to the server. Those files can then be used to create and execute arbitrary PHP, yielding full remote code execution and site compromise. Fixed in Avada 7.16.1 / Fusion Builder 3.16.1 (2026-08-26).

CVE-2026-19632 (CVSS 9.8, CWE-640) affects TranslatePress (<=3.3.1, 400,000+ installs) via the unauthenticated 'trp_get_translations_regular' AJAX action. When automatic string saving is enabled and an administrator's profile language is set to a published secondary language, the plugin's password-reset email link -- including the plaintext reset key -- gets written into the plugin's translation dictionary table, from which any unauthenticated visitor can retrieve it via the AJAX action and take over the administrator account. Reported by researcher momopon1415 through the Wordfence Bug Bounty Program (rewarded $975); fixed in 3.3.2 (2026-08-13).

CVE-2026-19598 (CVSS 9.8, CWE-863) affects Pods - Custom Content Types and Fields (<=3.3.9, 100,000+ installs). The pods_admin AJAX router funnels every access check -- method allowlist, nonce verification, login enforcement, and capability gate -- through the pods_error() function, which under the JSON meta-box-loader compatibility code path only writes the failure to the PHP error log and returns false instead of terminating the request, rendering every guard ineffective. This lets an unauthenticated attacker escalate to Administrator or overwrite any user's password, including the site owner's. A public Python proof-of-concept (DeadExpl0it/CVE-2026-19598-PoC on GitHub) demonstrating the exploit is already available, despite initial reporting that no PoC existed. Fixed across branches: 3.3.9.1, 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4.

CVE-2026-82222 (CVSS 10.0, CWE-502) affects GiveWP (<=4.16.7.1, 100,000+ installs). Researcher Udin Chan (reported to Patchstack 2026-07-28) found that GiveWP's safeUnserialize() helper (src/Helpers/Utils.php) calls PHP's unserialize() with allowed_classes=>false, which converts injected objects into __PHP_Incomplete_Class placeholders rather than neutralizing them; on re-serialization the original attacker bytes are written back out intact. The donation-processing flow (includes/process-donation.php) passes user-controlled account metadata such as last_name through this helper via array_map() and persists it, unsanitized, in the wp_give_sessions table. A later, unguarded read of that stored payload triggers PHP object destruction, chaining through TCPDF::__destruct() -> _destroy() -> ProviderForwarder::__call() (src/TestData/Framework/ProviderForwarder.php) -> call_user_func_array(), where the attacker-controlled loadedProviders array can point at system(), yielding arbitrary OS command execution as the web-server user. Exploitation requires only one published donation form and one active payment gateway; the default 'manual' (Test Donation) and 'offline' gateways ship active out of the box, making fresh installs trivially exploitable. Fixed in 4.16.7.2 (2026-08-27) with five layered mitigations: write-path rejection of serialized data in name fields, allowed_classes=>false at three read sinks, contract validation in ProviderForwarder::__call(), sanitize_text_field() on stored metadata, and a SanitizeSerializedObjectPayloads migration to purge existing payload remnants from the database.

As of publication, CISA's Known Exploited Vulnerabilities catalog does not list any of the five CVEs, and no confirmed in-the-wild exploitation has been reported for any of them. However, the presence of a public PoC for CVE-2026-19598 means at least one of the five should be treated as immediately weaponizable, and defenders running any of these five products should patch on an emergency basis rather than a routine cycle given the unauthenticated, network-exploitable, full-takeover nature of every flaw in this set.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Collection

T1213 Data from Information Repositories

Impact

T1491 Defacement

lateral-movement

T1550.001 Application Access Token

Remediation for Five WordPress plugins CVSS 10.0

Patches

• WPMU DEV Dashboard 5.0.2 (released 2026-08-24)
• Avada 7.16.1 / Fusion Builder 3.16.1 (released 2026-08-26)
• TranslatePress 3.3.2 (released 2026-08-13)
• Pods 3.3.9.1 and legacy-branch backports 2.8.23.4 / 2.9.19.4 / 3.0.10.4 / 3.1.4.2 / 3.2.8.3
• GiveWP 4.16.7.2 (released 2026-08-27) with write-path rejection, read-sink allowed_classes=>false, gadget-chain contract validation, metadata sanitization, and a database-cleanup migration

Immediate actions

• Update WPMU DEV Dashboard to 5.0.2 or later to remediate CVE-2026-76581
• Update Avada theme to 7.16.1 and Fusion Builder to 3.16.1 or later to remediate CVE-2026-18431
• Update TranslatePress to 3.3.2 or later to remediate CVE-2026-19632
• Update Pods to 3.3.9.1 (or the matching legacy-branch patch: 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3) to remediate CVE-2026-19598
• Update GiveWP to 4.16.7.2 or later to remediate CVE-2026-82222

Workarounds

• Where immediate patching is not possible: disable Hub SSO, disable automatic string saving in TranslatePress, deactivate Fusion Builder form processing, or disable the GiveWP Test Donation/offline gateways to reduce exposure until the corresponding update can be applied

Longer-term hardening

• Disable WPMU DEV Hub SSO mapping to administrator accounts on sites that do not require it
• Disable automatic string saving in TranslatePress unless required, and rotate administrator credentials if a secondary published language was ever mapped to an admin profile
• After patching GiveWP, audit the wp_give_sessions table for residual serialized payloads even though the vendor migration removes known remnants
• Deploy WAF rules (e.g. Wordfence Premium/Care/Response) ahead of the free-tier rule release window for each advisory
• Run recurring WordPress plugin/theme vulnerability scanning (e.g. WPScan) against all five affected products

Affected and fixed versions

• WPMU DEV (Incsub) — WPMU DEV Dashboard
  Vulnerable versions: <=5.0.1
  Fixed in: 5.0.2
• ThemeFusion — Avada
  Vulnerable versions: <=7.16 (with Fusion Builder <=3.16 active)
  Fixed in: 7.16.1
• ThemeFusion — Fusion Builder
  Vulnerable versions: <=3.16
  Fixed in: 3.16.1
• Cozmoslabs — TranslatePress – Translate Multilingual sites with AI Translation
  Vulnerable versions: <=3.3.1 (with automatic string saving enabled)
  Fixed in: 3.3.2
• Pods Foundation — Pods – Custom Content Types and Fields
  Vulnerable versions: <=3.3.9
  Fixed in: 3.3.9.1; 3.2.8.3; 3.1.4.2; 3.0.10.4; 2.9.19.4; 2.8.23.4
• StellarWP (Liquid Web) — GiveWP – Donation Plugin and Fundraising Platform
  Vulnerable versions: <=4.16.7.1
  Fixed in: 4.16.7.2

Timeline of Five WordPress plugins CVSS 10.0

Last updated 2026-08-31 · revalidated 1× · latest source

• 2026-07-28 Researcher Udin Chan reports the GiveWP PHP object-injection/RCE flaw to locked-ioc-20; CVE-2026-82222 is assigned.
• 2026-08-13 locked-ioc-19 releases TranslatePress 3.3.2, fixing the CVE-2026-19632 password-reset-URL exposure; researcher momopon1415 is credited a $975 locked-ioc-21 Bug Bounty reward.
• 2026-08-15 CVE-2026-19598 (locked-ioc-23 pods_admin authorization-bypass privilege escalation) is published/assigned by locked-ioc-21.
• 2026-08-19 locked-ioc-21 researcher locked-ioc-18, assisted by the locked-ioc-21 Argus AI research system, discovers the WPMU DEV Dashboard Hub SSO HMAC canonicalization-confusion authentication bypass (CVE-2026-76581).
• 2026-08-24 WPMU DEV releases Dashboard plugin version 5.0.2, fixing CVE-2026-76581.
• 2026-08-25 locked-ioc-21 deploys a Premium/Care/Response-tier firewall rule protecting customers against CVE-2026-76581 exploitation attempts.
• 2026-08-26 locked-ioc-17 releases locked-ioc-22 7.16.1 and Fusion Builder 3.16.1, fixing the six-step unauthenticated arbitrary-file-write chain tracked as CVE-2026-18431.
• 2026-08-27 GiveWP (StellarWP/Liquid Web) releases version 4.16.7.2 with five layered mitigations for the CVE-2026-82222 PHP object-injection/RCE gadget chain.
• 2026-08-28 CVE-2026-76581, CVE-2026-18431, and CVE-2026-82222 are formally published across locked-ioc-21 and locked-ioc-20 advisories and NVD records.
• 2026-08-29 The Hacker News publishes a consolidated roundup covering all five critical WordPress plugin/theme vulnerabilities, prompting TL-Intel Harness ingestion.
• 2026-09-24 locked-ioc-21 free-tier users are scheduled to receive the CVE-2026-76581 firewall rule, 30 days after the Premium rollout.

Update history

• 2026-08-31 — CVE-2026-76581: Critical Authentication Bypass in WPMU DEV Dashboard Plugin Allows Unauthenticated Admin Takeover: What changed No escalation to the cluster-level record: CVE-2026-76581's patch (5.0.2, 2026-08-24) was already reflected in the existing remediation/timeline, and the overall record's ACTIVE status/POC_PUBLIC exploitability correctly remain

Sources cited for Five WordPress plugins CVSS 10.0

• WPMU DEV Dashboard <=5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion wordfence.com · Advisory · 2026-08-24
• Avada Theme / Fusion Builder Arbitrary File Write to RCE Advisory wordfence.com · Advisory · 2026-08-26
• Pods Privilege Escalation via Authorization Bypass Advisory wordfence.com · Advisory · 2026-08-15
• WordPress GiveWP Plugin <=4.16.7.1 - Remote Code Execution (RCE) Vulnerability patchstack.com · Advisory · 2026-08-28
• Avada <=7.16 and Fusion Builder <=3.16 – Unauthenticated Remote Code Execution via Arbitrary File Write wpscan.com · Advisory · 2026-08-28
• Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP patchstack.com · Research · 2026-08-28
• CVE-2026-18431 – Unauthenticated Remote Code Execution via Arbitrary File Write – Avada Theme ionix.io · Research · 2026-08-28
• Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE The Hacker News · News · 2026-08-29
• Critical Avada WordPress theme flaw enables zero-click RCE BleepingComputer · News · 2026-08-28
• WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks cybersecuritynews.com · News · 2026-08-27
• Account Takeover Flaw Hits TranslatePress Plugin Used on 400K WordPress Sites hackread.com · News · 2026-08-27

Threats related to Five WordPress plugins CVSS 10.0

• Critical Avada WordPress Theme Flaw (CVE-2026-18431) Enables Zero-Click RCE
• GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands
• WordPress Kirki Plugin CVE-2026-8206 — Unauthenticated Account Takeover via Password-Reset Email Hijack (Active Exploitation, ~500K Sites)
• Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475)
• CVE-2026-8713: Avada (Fusion) Builder WordPress Plugin Unauthenticated Path Traversal Arbitrary File Deletion

Related coverage of this activity

• Forminator unauthenticated RCE