Five critical vulnerabilities rated between CVSS 9.8 and 10.0 in widely-used WordPress plugins and themes could allow unauthenticated attackers to take over sites or achieve remote code execution, according to disclosure published August 29 by Wordfence and Patchstack. The flaws affect WPMU DEV Dashboard, Avada Theme, TranslatePress, Pods, and GiveWP, creating significant attack surface across millions of WordPress installations. The highest severity rating—CVSS 10.0—was assigned to a PHP object injection flaw in GiveWP that enables arbitrary command execution with no authentication required.
CVE-2026-82222: GiveWP Plugin’s PHP Object Injection Rated CVSS 10.0
CVE-2026-82222, affecting GiveWP Plugin up to version 4.16.7.1, carries a CVSS score of 10.0 due to a PHP object injection vulnerability that allows attackers to achieve remote code execution and execute arbitrary commands on the server. The flaw represents complete compromise potential with no authentication required and no user interaction needed. GiveWP is a donation and fundraising plugin used across thousands of nonprofit and organizational sites, making the attack surface particularly broad for an unauthenticated RCE vulnerability.
The CVSS 10.0 score reflects the complete absence of mitigating factors: an unauthenticated attacker can achieve full system compromise through a single exploit chain without requiring any privileged access or social engineering. PHP object injection vulnerabilities occur when an application deserializes untrusted user input without proper validation, allowing attackers to instantiate arbitrary PHP objects and trigger malicious code execution paths. In GiveWP’s case, this leads directly to remote code execution, giving attackers complete control over the vulnerable WordPress installation.
CVE-2026-76581: WPMU DEV Dashboard Authentication Bypass Grants Administrator Access
CVE-2026-76581 (CVSS 9.8) in WPMU DEV Dashboard up to version 5.0.1 permits authentication bypass, allowing unauthenticated attackers to obtain administrator access to the WordPress installation. WPMU DEV Dashboard is a site management and maintenance plugin used by WordPress site administrators to centrally manage multiple WordPress installations. The authentication bypass flaw gives attackers the same administrative privileges as the site owner, enabling them to install malicious plugins, modify site content, create new administrator accounts, or exfiltrate sensitive data.
CVE-2026-18431: Avada Theme with Fusion Builder Arbitrary File Write Enables RCE
CVE-2026-18431 (CVSS 9.8) in Avada Theme up to version 7.16, when used with the Fusion Builder plugin up to version 3.16, introduces an arbitrary file write flaw that enables remote code execution and complete site compromise. Avada is one of the most popular commercial WordPress themes, with hundreds of thousands of installations. The arbitrary file write vulnerability allows attackers to upload malicious PHP files to the web server and then execute them by requesting the file path, achieving remote code execution without authentication.
CVE-2026-19632 and CVE-2026-19598: TranslatePress Password Reset Exposure and Pods Privilege Escalation
CVE-2026-19632 (CVSS 9.8) in TranslatePress Plugin up to version 3.3.1 exposes sensitive information that allows attackers to extract password-reset URLs for administrator accounts and take over those accounts. TranslatePress is a multilingual WordPress plugin that allows site operators to translate their content into multiple languages. The password-reset URL exposure vulnerability gives attackers access to one-time password reset links that they can use to change administrator passwords and gain full site access.
CVE-2026-19598 (CVSS 9.8) in Pods Plugin up to version 3.3.9 permits privilege escalation, enabling attackers to overwrite passwords and achieve complete site takeover. Pods is a content framework plugin that extends WordPress’s custom post types and fields capabilities. The privilege escalation flaw allows attackers to overwrite user passwords, including administrator passwords, effectively granting them full administrative control over the WordPress installation.
Wordfence and Patchstack Disclosure Urges Immediate Updates Across Millions of Sites
The combined install base of the affected plugins and themes represents a significant portion of the WordPress ecosystem. The disclosure published August 29 did not specify patch availability or remediation timelines, but site administrators were urged to update affected components immediately. Wordfence and Patchstack credited for the vulnerability research and disclosure coordination.
The five flaws share a common risk profile: each permits either authentication bypass or privilege escalation leading to administrative control, and two enable remote code execution outright. Site operators running any of the five affected components face immediate risk of takeover if patches are not applied. The August 29 disclosure creates a narrow window for site administrators to patch before proof-of-concept exploits or active exploitation campaigns emerge, as CVSS 9.8 and 10.0 vulnerabilities typically attract rapid attacker attention once publicly disclosed.
