Five critical WordPress flaws disclosed in plugins and a theme can expose websites to administrator takeover or remote code execution, security researchers reported on August 29. The issues affect WPMU DEV Dashboard, Avada with Fusion Builder, TranslatePress, Pods and GiveWP. Four received CVSS scores of 9.8, while the GiveWP vulnerability received the maximum score of 10.0. No public exploitation was reported when the disclosures were published.

Wordfence identified CVE-2026-76581 in WPMU DEV Dashboard, affecting versions through 5.0.1. On sites connected to WPMU DEV with Hub Single Sign-On enabled and mapped to an administrator, an unauthenticated attacker could bypass authentication and take control of the site. Wordfence said version 5.0.2, released on August 24, addresses the weakness.

CVE-2026-18431 affects Avada through version 7.16 when Fusion Builder through version 3.16 is active. According to the disclosure, an unauthenticated attacker can write a chosen file to the server and potentially place executable PHP in a web-accessible location, producing remote code execution. Administrators should verify both the theme and builder versions because the vulnerable path depends on the combination.

Two other flaws lead to account takeover. CVE-2026-19632 in TranslatePress through version 3.3.1 can expose an administrator password-reset URL when automatic string saving is enabled and the administrator uses a published secondary language. CVE-2026-19598 in Pods through version 3.3.9 allows an unauthenticated attacker to elevate privileges to administrator or change another user’s password.

Patchstack documented CVE-2026-82222 in GiveWP through version 4.16.7.1. A site is exposed when it has a published donation form and an active payment gateway. Attacker-controlled donation data can reach unsafe PHP object deserialization and use a bundled gadget chain to execute operating-system commands. GiveWP version 4.16.7.2 contains the fix, according to the disclosure.

WordPress operators should inventory the affected components, install fixed releases and deactivate vulnerable software when an update cannot be applied. Defenders should review web-server and WordPress logs for unexpected password resets, new administrator accounts, unusual donation requests and unfamiliar PHP files. If server-level execution is suspected, they should preserve evidence, compare files with trusted packages, rotate administrative and hosting credentials, and restore from a known-clean backup where necessary.