Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
- ID
- 19446
- Status
- summarized
- Published
- 30 Aug 2026, 12:25 AM
- Fetched
- 30 Aug 2026, 1:56 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 30 Aug 2026, 1:57 AM
- Tags
- Audience
- developerssaas_founders
What happened
Five critical WordPress plugin and theme vulnerabilities (CVSS 9.8–10.0) were disclosed by Wordfence and Patchstack, affecting WPMU DEV Dashboard (≤5.0.1, auth bypass via Hub SSO), Avada theme (≤7.16 with Fusion Builder ≤3.16, arbitrary file write leading to RCE), TranslatePress (≤3.3.1, password-reset URL exposure under specific config), Pods (≤3.3.9, privilege escalation to admin), and GiveWP (RCE with one published donation form and one active payment gateway). All enable unauthenticated site takeover or remote code execution.
Why it matters
If you run any of these plugins or themes, patch now—each flaw lets an unauthenticated attacker gain admin or execute code. Check specifically for Avada + Fusion Builder combos and GiveWP donation forms, since those are common on Malaysian SMB and NGO sites. TranslatePress only fires if automatic string saving is on and an admin's locale is set to a published secondary language, so disabling that config is an interim mitigation if you can't update immediately.
Discussion angle
How many of your client or side-project WordPress sites still run these plugins unpatched, and what's your patch workflow when 9.8+ CVEs drop—do you have inventory of which plugins are installed where?