# Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP

> Five unrelated CVSS 9.8-10.0 vulnerabilities disclosed within a two-week window across widely-installed WordPress plugins and themes (WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP) each allow an unauthenticated attacker to reach full administrator access or remote code execution through a different root cause: HMAC canonicalization confusion, a chained arbitrary-file-write, an AJAX information-disclosure bug, an authorization-bypass privilege escalation, and a PHP object-injection gadget chain. All five vendors shipped fixes before or around public disclosure, and a public proof-of-concept exploit for one of the five (Pods, CVE-2026-19598) is already circulating on GitHub, contradicting the initial no-PoC assessment.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-31T02:41:20.236Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2210
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-five-wordpress-plugins-cvss-10-0-tl-2026-2210.webp?v=6af04773 (Threadlinqs threat intel: CVE-2026-76581 WPMU DEV Auth Bypass: Detection & IOCs (TL-2026-2210) — Critical severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2210
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (1 shown free below)
- **CVEs:** CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, CVE-2026-82222

## Description

On 2026-08-29, The Hacker News published a consolidated roundup of five critical, independently-discovered vulnerabilities disclosed across popular WordPress plugins and themes between 2026-08-13 and 2026-08-28. Despite the shared publication window, the five CVEs are unrelated supply-chain findings in separate codebases with no evidence of a common threat actor or coordinated campaign; the grouping reflects a disclosure cluster, not a single exploit chain.

CVE-2026-76581 (CVSS 9.8, CWE-347) affects the WPMU DEV Dashboard plugin (<=5.0.1, ~350,000 installs). Wordfence researcher Alex Thomas, assisted by the Wordfence Argus AI research system, found that the plugin's Hub Single Sign-On (SSO) handshake constructs and validates HMAC-SHA-256 signatures inconsistently: an unauthenticated first-stage endpoint acts as a signing oracle whose valid HMAC output can be replayed in a different logical context, letting an unauthenticated attacker obtain administrator access on any site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator. Fixed in 5.0.2 (2026-08-24).

CVE-2026-18431 (CVSS 9.8, CWE-862) affects the Avada theme (<=7.16, 1M+ sales) when the bundled Fusion Builder plugin (<=3.16) is active. Wordfence chained six separate authorization and input-validation weaknesses spanning both components -- from exposing attacker-controlled input through a public request, to invoking a privileged component out of context, to bypassing file-handling restrictions -- into a single unauthenticated, zero-click attack that writes attacker-controlled files to the server. Those files can then be used to create and execute arbitrary PHP, yielding full remote code execution and site compromise. Fixed in Avada 7.16.1 / Fusion Builder 3.16.1 (2026-08-26).

CVE-2026-19632 (CVSS 9.8, CWE-640) affects TranslatePress (<=3.3.1, 400,000+ installs) via the unauthenticated 'trp_get_translations_regular' AJAX action. When automatic string saving is enabled and an administrator's profile language is set to a published secondary language, the plugin's password-reset email link -- including the plaintext reset key -- gets written into the plugin's translation dictionary table, from which any unauthenticated visitor can retrieve it via the AJAX action and take over the administrator account. Reported by researcher momopon1415 through the Wordfence Bug Bounty Program (rewarded $975); fixed in 3.3.2 (2026-08-13).

CVE-2026-19598 (CVSS 9.8, CWE-863) affects Pods - Custom Content Types and Fields (<=3.3.9, 100,000+ installs). The pods_admin AJAX router funnels every access check -- method allowlist, nonce verification, login enforcement, and capability gate -- through the pods_error() function, which under the JSON meta-box-loader compatibility code path only writes the failure to the PHP error log and returns false instead of terminating the request, rendering every guard ineffective. This lets an unauthenticated attacker escalate to Administrator or overwrite any user's password, including the site owner's. A public Python proof-of-concept (DeadExpl0it/CVE-2026-19598-PoC on GitHub) demonstrating the exploit is already available, despite initial reporting that no PoC existed. Fixed across branches: 3.3.9.1, 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4.

CVE-2026-82222 (CVSS 10.0, CWE-502) affects GiveWP (<=4.16.7.1, 100,000+ installs). Researcher Udin Chan (reported to Patchstack 2026-07-28) found that GiveWP's safeUnserialize() helper (src/Helpers/Utils.php) calls PHP's unserialize() with allowed_classes=>false, which converts injected objects into __PHP_Incomplete_Class placeholders rather than neutralizing them; on re-serialization the original attacker bytes are written back out intact. The donation-processing flow (includes/process-donation.php) passes user-controlled account metadata such as last_name through this helper via array_map() and persists it, unsanitized, in the wp_give_sessions table. A later, unguarded read of that stored payload triggers PHP object destruction, chaining through TCPDF::__destruct() -> _destroy() -> ProviderForwarder::__call() (src/TestData/Framework/ProviderForwarder.php) -> call_user_func_array(), where the attacker-controlled loadedProviders array can point at system(), yielding arbitrary OS command execution as the web-server user. Exploitation requires only one published donation form and one active payment gateway; the default 'manual' (Test Donation) and 'offline' gateways ship active out of the box, making fresh installs trivially exploitable. Fixed in 4.16.7.2 (2026-08-27) with five layered mitigations: write-path rejection of serialized data in name fields, allowed_classes=>false at three read sinks, contract validation in ProviderForwarder::__call(), sanitize_text_field() on stored metadata, and a SanitizeSerializedObjectPayloads migration to purge existing payload remnants from the database.

As of publication, CISA's Known Exploited Vulnerabilities catalog does not list any of the five CVEs, and no confirmed in-the-wild exploitation has been reported for any of them. However, the presence of a public PoC for CVE-2026-19598 means at least one of the five should be treated as immediately weaponizable, and defenders running any of these five products should patch on an emergency basis rather than a routine cycle given the unauthenticated, network-exploitable, full-takeover nature of every flaw in this set.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1550.001 Application Access Token
- T1098 Account Manipulation
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories
- T1505.003 Web Shell
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1136 Create Account
- T1552 Unsecured Credentials
- T1491 Defacement

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster)** (`TL-2026-2210-SPL-001`)

Detects unauthenticated or pre-auth HTTP requests to the specific AJAX/REST/form endpoints abused by the five 2026-08 critical WordPress plugin/theme CVEs: TranslatePress's trp_get_translations_regular AJAX action (CVE-2026-19632), Pods' pods_admin AJAX router (CVE-2026-19598), WPMU DEV Dashboard's Hub SSO handshake endpoint (CVE-2026-76581), Fusion Builder POST handlers bundled with Avada (CVE-2026-18431), and GiveWP donation submissions to the default manual/offline gateways (CVE-2026-82222). A successful (2xx/403) hit on any of these endpoints from an anonymous session is the initial-access trigger for full site takeover or RCE.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1199, T1550.001
- **Data sources:** apache_access, nginx_access, azure_app_service_http_logs, iis_w3c_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=apache_access OR sourcetype=nginx_access OR sourcetype=wordpress:access)
| eval vuln_endpoint=case(
    like(uri_query, "%action=trp_get_translations_regular%"), "translatepress_cve_2026_19632",
    like(uri_path, "%/wp-admin/admin-ajax.php%") AND like(uri_query, "%action=pods_admin%"), "pods_cve_2026_19598",
    like(uri_path, "%/wp-json/wpmudev%") OR like(uri_path, "%/wp-content/plugins/wpmudev-updates/%"), "wpmudev_hub_sso_cve_2026_76581",
    like(uri_path, "%fusion-builder%") AND method="POST", "avada_fusion_cve_2026_18431",
    (like(uri_path, "%/wp-json/give-api%") OR (like(uri_path, "%/?give_action=%"))) AND (like(uri_query, "%gateway=manual%") OR like(uri_query, "%gateway=offline%")), "givewp_cve_2026_82222")
| where isnotnull(vuln_endpoint)
| where status<300 OR status=403
| eval is_authenticated=if(match(cookie, "wordpress_logged_in"), 1, 0)
| where is_authenticated=0
| stats count as hit_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(uri_path) as paths, values(http_user_agent) as user_agents by src_ip, vuln_endpoint
| where hit_count>=1
| sort -hit_count
```

### Microsoft KQL

```kql
let VulnEndpoints = AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category in ("AppServiceHTTPLogs", "IISLog")
| extend UriPath = tostring(cs_uri_stem_s), UriQuery = tostring(cs_uri_query_s), Method = tostring(sc_method_s), Status = toint(sc_status_s), ClientIP = tostring(c_ip_s), UA = tostring(cs_User_Agent_s), Cookie = tostring(cs_Cookie_s)
| extend VulnEndpoint = case(
    UriQuery has "action=trp_get_translations_regular", "translatepress_cve_2026_19632",
    UriPath has "admin-ajax.php" and UriQuery has "action=pods_admin", "pods_cve_2026_19598",
    UriPath has "wp-json/wpmudev" or UriPath has "wpmudev-updates", "wpmudev_hub_sso_cve_2026_76581",
    UriPath has "fusion-builder" and Method == "POST", "avada_fusion_cve_2026_18431",
    (UriPath has "give-api" or UriPath has "give_action") and (UriQuery has "gateway=manual" or UriQuery has "gateway=offline"), "givewp_cve_2026_82222",
    "")
| where VulnEndpoint != ""
| where Status < 300 or Status == 403
| where Cookie !has "wordpress_logged_in";
VulnEndpoints
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(UriPath), UserAgents = make_set(UA) by ClientIP, VulnEndpoint
| sort by HitCount desc
```

### Sigma

```yaml
title: Unauthenticated Access to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster Aug 2026)
id: 7a2c1e4f-3b9d-4a71-9e2c-1f6a8d0b5c31
status: experimental
description: Detects anonymous HTTP requests to the specific vulnerable endpoints for CVE-2026-76581 (WPMU DEV Dashboard), CVE-2026-18431 (Avada/Fusion Builder), CVE-2026-19632 (TranslatePress), CVE-2026-19598 (Pods), and CVE-2026-82222 (GiveWP).
references:
    - https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpmudev-updates/wpmu-dev-dashboard-501-authentication-bypass-to-administrator-via-sso-hmac-canonicalization-confusion
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1199
    - attack.t1550.001
    - cve.2026.76581
    - cve.2026.18431
    - cve.2026.19632
    - cve.2026.19598
    - cve.2026.82222
logsource:
    category: webserver
detection:
    selection_translatepress:
        cs-uri-query|contains: 'action=trp_get_translations_regular'
    selection_pods:
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pods_admin'
    selection_wpmudev:
        c-uri|contains:
            - '/wp-json/wpmudev'
            - '/wp-content/plugins/wpmudev-updates/'
    selection_avada:
        c-uri|contains: 'fusion-builder'
        cs-method: 'POST'
    selection_givewp:
        c-uri|contains:
            - '/wp-json/give-api'
            - 'give_action='
        cs-uri-query|contains:
            - 'gateway=manual'
            - 'gateway=offline'
    filter_authenticated:
        cs-cookie|contains: 'wordpress_logged_in'
    condition: (selection_translatepress or selection_pods or selection_wpmudev or selection_avada or selection_givewp) and not filter_authenticated
falsepositives:
    - Legitimate anonymous visitors submitting a donation form through GiveWP's default gateways
    - Automated uptime/health-check bots crawling admin-ajax.php for unrelated plugin actions
level: high
```

**Known false positives:**

- Legitimate anonymous donors submitting a GiveWP donation through the manual/offline gateway
- Third-party translation-management crawlers hitting admin-ajax.php with unrelated actions
- Uptime/health-check monitors probing wp-json REST discovery routes

**Tuning notes:** Baseline legitimate GiveWP donation volume per site before enabling alerting on the givewp_cve_2026_82222 bucket; exclude known WPScan/uptime-monitor source IPs; if the site does not use WPMU DEV Hub SSO, treat any hit on that endpoint as high-confidence malicious with no tuning needed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster) (locked: unlock with TL Creds)
- Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration (locked: unlock with TL Creds)
- OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) (locked: unlock with TL Creds)
- Unauthenticated Requests to Critical WordPress Plugin/Theme Endpoints (5-CVE Cluster) (locked: unlock with TL Creds)
- Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration (locked: unlock with TL Creds)
- OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) (locked: unlock with TL Creds)
- Post-Exploitation: Webshell Drop, Serialized-Object Persistence & Password-Reset Key Exfiltration (locked: unlock with TL Creds)
- OS Command Execution Spawned from PHP-FPM/Web-Server Process (GiveWP Gadget-Chain RCE Terminus) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 24)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/DeadExpl0it/CVE-2026-19598-PoC`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE](https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html)
- [WPMU DEV Dashboard <=5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpmudev-updates/wpmu-dev-dashboard-501-authentication-bypass-to-administrator-via-sso-hmac-canonicalization-confusion)
- [Avada Theme / Fusion Builder Arbitrary File Write to RCE Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390?source=cve)
- [Pods Privilege Escalation via Authorization Bypass Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f?source=cve)
- [Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP](https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp?_s_id=cve)
- [WordPress GiveWP Plugin <=4.16.7.1 - Remote Code Execution (RCE) Vulnerability](https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability?_s_id=cve)
- [Critical Avada WordPress theme flaw enables zero-click RCE](https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/)
- [CVE-2026-18431 – Unauthenticated Remote Code Execution via Arbitrary File Write – Avada Theme](https://www.ionix.io/threat-center/cve-2026-18431/)
- [Avada <=7.16 and Fusion Builder <=3.16 – Unauthenticated Remote Code Execution via Arbitrary File Write](https://wpscan.com/vulnerability/ed93bc31-c3d3-46c9-b738-76e2d6e49147/)
- [WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks](https://cybersecuritynews.com/translatepress-wordpress-plugin-vulnerability/)
- [Account Takeover Flaw Hits TranslatePress Plugin Used on 400K WordPress Sites](https://hackread.com/account-takeover-flaw-translatepress-plugin-wordpress/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2210