Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP

Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) (TL-2026-2210) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-29 and last reviewed 2026-08-31. It has no confirmed attribution, affects WPMU DEV (Incsub) WPMU DEV Dashboard, references 5 CVEs (CVE-2026-76581, CVE-2026-18431, CVE-2026-19632), maps to 12 MITRE ATT&CK techniques (T1059.004, T1068, T1098), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2210

Threat ID
TL-2026-2210
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-29
Last reviewed
2026-08-31
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
nonprofit, technology, government administration, financial-services, health, education, news - media, ecommerce, professional-services
Target regions
Global
Detection rules
9
Indicators of compromise
24
Updates
2026-08-31 · revalidated 1× · latest source

Five unrelated CVSS 9.8-10.0 vulnerabilities disclosed within a two-week window across widely-installed WordPress plugins and themes (WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP) each allow an unauthenticated attacker to reach full administrator access or remote code execution through a different root cause: HMAC canonicalization confusion, a chained arbitrary-file-write, an AJAX information-disclosure bug, an authorization-bypass privilege escalation, and a PHP object-injection gadget chain. All five vendors shipped fixes before or around public disclosure, and a public proof-of-concept exploit for one of the five (Pods, CVE-2026-19598) is already circulating on GitHub, contradicting the initial no-PoC assessment.

How Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) works

On 2026-08-29, The Hacker News published a consolidated roundup of five critical, independently-discovered vulnerabilities disclosed across popular WordPress plugins and themes between 2026-08-13 and 2026-08-28. Despite the shared publication window, the five CVEs are unrelated supply-chain findings in separate codebases with no evidence of a common threat actor or coordinated campaign; the grouping reflects a disclosure cluster, not a single exploit chain.

CVE-2026-76581 (CVSS 9.8, CWE-347) affects the WPMU DEV Dashboard plugin (<=5.0.1, ~350,000 installs). Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, found that the plugin's Hub Single Sign-On (SSO) handshake constructs and validates HMAC-SHA-256 signatures inconsistently: an unauthenticated first-stage endpoint acts as a signing oracle whose valid HMAC output can be replayed in a different logical context, letting an unauthenticated attacker obtain administrator access on any site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator. Fixed in 5.0.2 (2026-08-24).

CVE-2026-18431 (CVSS 9.8, CWE-862) affects the Avada theme (<=7.16, 1M+ sales) when the bundled Fusion Builder plugin (<=3.16) is active. Wordfence chained six separate authorization and input-validation weaknesses spanning both components -- from exposing attacker-controlled input through a public request, to invoking a privileged component out of context, to bypassing file-handling restrictions -- into a single unauthenticated, zero-click attack that writes attacker-controlled files to the server. Those files can then be used to create and execute arbitrary PHP, yielding full remote code execution and site compromise. Fixed in Avada 7.16.1 / Fusion Builder 3.16.1 (2026-08-26).

CVE-2026-19632 (CVSS 9.8, CWE-640) affects TranslatePress (<=3.3.1, 400,000+ installs) via the unauthenticated 'trp_get_translations_regular' AJAX action. When automatic string saving is enabled and an administrator's profile language is set to a published secondary language, the plugin's password-reset email link -- including the plaintext reset key -- gets written into the plugin's translation dictionary table, from which any unauthenticated visitor can retrieve it via the AJAX action and take over the administrator account. Reported by researcher momopon1415 through the Wordfence Bug Bounty Program (rewarded $975); fixed in 3.3.2 (2026-08-13).

CVE-2026-19598 (CVSS 9.8, CWE-863) affects Pods - Custom Content Types and Fields (<=3.3.9, 100,000+ installs). The pods_admin AJAX router funnels every access check -- method allowlist, nonce verification, login enforcement, and capability gate -- through the pods_error() function, which under the JSON meta-box-loader compatibility code path only writes the failure to the PHP error log and returns false instead of terminating the request, rendering every guard ineffective. This lets an unauthenticated attacker escalate to Administrator or overwrite any user's password, including the site owner's. A public Python proof-of-concept (DeadExpl0it/CVE-2026-19598-PoC on GitHub) demonstrating the exploit is already available, despite initial reporting that no PoC existed. Fixed across branches: 3.3.9.1, 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4.

CVE-2026-82222 (CVSS 10.0, CWE-502) affects GiveWP (<=4.16.7.1, 100,000+ installs). Researcher Udin Chan (reported to Patchstack 2026-07-28) found that GiveWP's safeUnserialize() helper (src/Helpers/Utils.php) calls PHP's unserialize() with allowed_classes=>false, which converts injected objects into __PHP_Incomplete_Class placeholders rather than neutralizing them; on re-serialization the original attacker bytes are written back out intact. The donation-processing flow (includes/process-donation.php) passes user-controlled account metadata such as last_name through this helper via array_map() and persists it, unsanitized, in the wp_give_sessions table. A later, unguarded read of that stored payload triggers PHP object destruction, chaining through TCPDF::__destruct() -> _destroy() -> ProviderForwarder::__call() (src/TestData/Framework/ProviderForwarder.php) -> call_user_func_array(), where the attacker-controlled loadedProviders array can point at system(), yielding arbitrary OS command execution as the web-server user. Exploitation requires only one published donation form and one active payment gateway; the default 'manual' (Test Donation) and 'offline' gateways ship active out of the box, making fresh installs trivially exploitable. Fixed in 4.16.7.2 (2026-08-27) with five layered mitigations: write-path rejection of serialized data in name fields, allowed_classes=>false at three read sinks, contract validation in ProviderForwarder::__call(), sanitize_text_field() on stored metadata, and a SanitizeSerializedObjectPayloads migration to purge existing payload remnants from the database.

As of publication, CISA's Known Exploited Vulnerabilities catalog does not list any of the five CVEs, and no confirmed in-the-wild exploitation has been reported for any of them. However, the presence of a public PoC for CVE-2026-19598 means at least one of the five should be treated as immediately weaponizable, and defenders running any of these five products should patch on an emergency basis rather than a routine cycle given the unauthenticated, network-exploitable, full-takeover nature of every flaw in this set.

MITRE ATT&CK techniques used in TL-2026-2210

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Collection

T1213 Data from Information Repositories

Impact

T1491 Defacement

lateral-movement

T1550.001 Application Access Token

Affected products and versions in Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

  • WPMU DEV (Incsub) — WPMU DEV Dashboard
    Vulnerable versions: <=5.0.1
    Fixed in: 5.0.2
  • ThemeFusion — Avada
    Vulnerable versions: <=7.16 (with Fusion Builder <=3.16 active)
    Fixed in: 7.16.1
  • ThemeFusion — Fusion Builder
    Vulnerable versions: <=3.16
    Fixed in: 3.16.1
  • Cozmoslabs — TranslatePress – Translate Multilingual sites with AI Translation
    Vulnerable versions: <=3.3.1 (with automatic string saving enabled)
    Fixed in: 3.3.2
  • Pods Foundation — Pods – Custom Content Types and Fields
    Vulnerable versions: <=3.3.9
    Fixed in: 3.3.9.1; 3.2.8.3; 3.1.4.2; 3.0.10.4; 2.9.19.4; 2.8.23.4
  • StellarWP (Liquid Web) — GiveWP – Donation Plugin and Fundraising Platform
    Vulnerable versions: <=4.16.7.1
    Fixed in: 4.16.7.2

Remediation for Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

Patches

  • WPMU DEV Dashboard 5.0.2 (released 2026-08-24)
  • Avada 7.16.1 / Fusion Builder 3.16.1 (released 2026-08-26)
  • TranslatePress 3.3.2 (released 2026-08-13)
  • Pods 3.3.9.1 and legacy-branch backports 2.8.23.4 / 2.9.19.4 / 3.0.10.4 / 3.1.4.2 / 3.2.8.3
  • GiveWP 4.16.7.2 (released 2026-08-27) with write-path rejection, read-sink allowed_classes=>false, gadget-chain contract validation, metadata sanitization, and a database-cleanup migration

Immediate actions

  • Update WPMU DEV Dashboard to 5.0.2 or later to remediate CVE-2026-76581
  • Update Avada theme to 7.16.1 and Fusion Builder to 3.16.1 or later to remediate CVE-2026-18431
  • Update TranslatePress to 3.3.2 or later to remediate CVE-2026-19632
  • Update Pods to 3.3.9.1 (or the matching legacy-branch patch: 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3) to remediate CVE-2026-19598
  • Update GiveWP to 4.16.7.2 or later to remediate CVE-2026-82222

Workarounds

  • Where immediate patching is not possible: disable Hub SSO, disable automatic string saving in TranslatePress, deactivate Fusion Builder form processing, or disable the GiveWP Test Donation/offline gateways to reduce exposure until the corresponding update can be applied

Longer-term hardening

  • Disable WPMU DEV Hub SSO mapping to administrator accounts on sites that do not require it
  • Disable automatic string saving in TranslatePress unless required, and rotate administrator credentials if a secondary published language was ever mapped to an admin profile
  • After patching GiveWP, audit the wp_give_sessions table for residual serialized payloads even though the vendor migration removes known remnants
  • Deploy WAF rules (e.g. Wordfence Premium/Care/Response) ahead of the free-tier rule release window for each advisory
  • Run recurring WordPress plugin/theme vulnerability scanning (e.g. WPScan) against all five affected products

CVEs associated with Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, CVE-2026-82222

Weaknesses (CWE) in Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

CWE-347, CWE-862, CWE-640, CWE-863, CWE-502

Timeline of Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

  • Researcher Udin Chan reports the GiveWP PHP object-injection/RCE flaw to Patchstack; CVE-2026-82222 is assigned.
  • Cozmoslabs releases TranslatePress 3.3.2, fixing the CVE-2026-19632 password-reset-URL exposure; researcher momopon1415 is credited a $975 Wordfence Bug Bounty reward.
  • CVE-2026-19598 (Pods pods_admin authorization-bypass privilege escalation) is published/assigned by Wordfence.
  • Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, discovers the WPMU DEV Dashboard Hub SSO HMAC canonicalization-confusion authentication bypass (CVE-2026-76581).
  • WPMU DEV releases Dashboard plugin version 5.0.2, fixing CVE-2026-76581.
  • Wordfence deploys a Premium/Care/Response-tier firewall rule protecting customers against CVE-2026-76581 exploitation attempts.
  • ThemeFusion releases Avada 7.16.1 and Fusion Builder 3.16.1, fixing the six-step unauthenticated arbitrary-file-write chain tracked as CVE-2026-18431.
  • GiveWP (StellarWP/Liquid Web) releases version 4.16.7.2 with five layered mitigations for the CVE-2026-82222 PHP object-injection/RCE gadget chain.
  • CVE-2026-76581, CVE-2026-18431, and CVE-2026-82222 are formally published across Wordfence and Patchstack advisories and NVD records.
  • The Hacker News publishes a consolidated roundup covering all five critical WordPress plugin/theme vulnerabilities, prompting TL-Intel Harness ingestion.
  • Wordfence free-tier users are scheduled to receive the CVE-2026-76581 firewall rule, 30 days after the Premium rollout.

Update history for TL-2026-2210

Sources cited for Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0)

More in vulnerability

Detection coverage for TL-2026-2210

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2210 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats