WordPress Ecosystem — Five Critical Plugin and Theme Flaws Enable Site Takeover and Remote Code Execution (CVE-2026-82222 et al.)

Publication date: August 29, 2026
Category: Vulnerability / Web Security

Introduction

Security researchers from Wordfence and Patchstack have disclosed a series of five critical-severity vulnerabilities impacting multiple widely used plugins and themes within the WordPress ecosystem. The affected components include WPMU DEV Dashboard, the Avada theme alongside Fusion Builder, TranslatePress, Pods, and GiveWP. These flaws allow unauthenticated threat actors to execute privileged actions, bypass access controls, extract sensitive password-reset data, and achieve remote code execution (RCE), ultimately leading to complete site takeover.

What is the Threat in the WordPress Ecosystem? (General Analysis)

The WordPress ecosystem heavily relies on third-party plugins and themes to extend core functionality. When these critical components suffer from architectural design defects or insufficient input validation, they expose the underlying web infrastructure to severe compromise.

This advisory covers five distinct attack vectors rated at the highest criticality levels:

  • CVE-2026-76581: Authentication Bypass in WPMU DEV Dashboard (CVSS 9.8, CWE-347).
  • CVE-2026-18431: Arbitrary File Write in the Avada theme and Fusion Builder (CVSS 9.8, CWE-862).
  • CVE-2026-19632: Sensitive Information Exposure in TranslatePress (CVSS 9.8, CWE-640).
  • CVE-2026-19598: Privilege Escalation via Authorization Bypass in Pods (CVSS 9.8, CWE-863).
  • CVE-2026-82222: Unauthenticated PHP Object Injection leading to RCE in GiveWP (CVSS 10.0, CWE-502).

All CVSS vector strings and CWE classifications mentioned are official confirmed facts retrieved directly from the NVD database.

How Does It Work? (Technical Analysis)

Each of the five vulnerabilities exploits flawed logic in input handling, cryptographic routines, or AJAX authorization workflows:

  • CVE-2026-76581 (WPMU DEV Dashboard): The flaw stems from inconsistent and ambiguous HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions. Step 1 signs and discloses an unseparated concatenation of token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation omitting the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, successfully acquiring an authenticated administrator session.
  • CVE-2026-18431 (Avada Theme & Fusion Builder): This vulnerability involves a chain of authorization and input validation weaknesses across both components up to version 7.16/3.16. It enables unauthenticated threat actors to write attacker-controlled files to the server, which can be exploited to create and execute arbitrary PHP files, resulting in remote code execution.
  • CVE-2026-19632 (TranslatePress): Through the trp_get_translations_regular AJAX action, unauthenticated attackers can extract raw administrator password-reset URLs in plaintext (including reset keys and login parameters) stored within translation dictionary tables, provided automatic string saving is enabled and the target administrator profile locale is set to a published secondary language.
  • CVE-2026-19598 (Pods): The pods_admin AJAX router funnels all access checks—including method allowlists, nonce verification, login enforcement, and capability gates—through pods_error(). Under the JSON compatibility path, this function merely writes failures to the PHP error log and returns false instead of terminating request execution, rendering all security guards ineffective and allowing privilege escalation to Administrator.
  • CVE-2026-82222 (GiveWP): An unauthenticated deserialization vulnerability affecting versions up to 4.16.7.1. It chains a broken “safe unserialize” helper, a donation workflow feeding attacker-controlled data into that helper, and a gadget chain present within shipped classes, ultimately leading to remote code execution.

Affected Systems / Environments

The specific components and version boundaries identified in this advisory include:

CVEComponentAffected VersionsCWEImpactCVSSVector (summarized)
CVE-2026-76581WPMU DEV DashboardUp to 5.0.1 inclusiveCWE-347Authentication Bypass9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-18431Avada / Fusion BuilderAvada <= 7.16, Fusion Builder <= 3.16CWE-862Arbitrary File Write / RCE9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-19632TranslatePressUp to 3.3.1 inclusiveCWE-640Sensitive Info Exposure9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-19598Pods – Custom Content TypesUp to 3.3.9 inclusiveCWE-863Privilege Escalation9.8AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-82222GiveWPUp to 4.16.7.1 inclusiveCWE-502Deserialization / RCE10.0AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Immediate Patching: Apply security updates released by respective plugin and theme developers as soon as they become available.
  • Plugin Auditing: Remove and uninstall any inactive, redundant, or abandoned plugins and themes from production environments.
  • Access Hardening: Enforce robust multi-factor authentication (MFA) for administrative accounts and implement web application firewall (WAF) rules to filter suspicious requests.

Detection

Defensive security teams should actively monitor audit trails and web server error logs for anomalous query patterns targeting WordPress AJAX endpoints, unexpected creation of PHP scripts within upload directories, or repeated requests aimed at translation endpoints and donation forms.

data-driven insights:

“Ambiguous cryptographic token concatenation, silent bypasses of access control fences, and the inclusion of libraries laden with pre-existing gadget chains highlight that state and input management in WordPress plugins remains a critical vector for enterprise compromise.”

Wrapping Up

The simultaneous disclosure of five critical flaws across prominent WordPress components underscores the constant attack surface facing corporate and personal web administrators. With severity scores peaking at 10.0, attackers possess automated pathways to achieve full site takeover without requiring prior credentials. Coordinated vendor patch releases require immediate adoption and verification by operations and security teams.

References