Critical vulnerabilities in WPMU DEV, Avada, TranslatePress, Pods and GiveWP open site taking and

In the latest technical notices published by security teams, multiple critical vulnerabilities were identified in plugins and WordPress themes that, together, open the door to complete site takes, remote code execution and administrative account commitments. The failures affect highly used components - WPMU DEV Dashboard, Avada (with Fusion Builder), TranslatePress, Pods and GiveWP - and are listed with very high CVSS scores and CVSS, which indicates risk of serious exploitation if no action is taken.

Confirmed facts: according to the reports cited by Wordfence and Patchstack, the vulnerabilities are as follows (summary of the technical data disseminated): CVE-2026-76581 (CVSS 9.8) - an authentication bypass on WPMU DEV Dashboard that allows an unauthenticated attacker to obtain administrator privileges in sites connected to WPMU DEV's Hub SSO when that SSO is mapped to an administrator (affects versions up to and including 5.0.1). CVE-2026-18431 (CVSS 9.8) - an arbitrary file writing on the Avada theme (with active Fusion Builder) that allows an attacker to upload and run PHP files, resulting in CERs (affects Avada up to 7.16 and Fusion Builder up to 3.16). CVE-2026-19632 (CVSS 9.8) - in TranslatePress, exposure of the administrator's password restoration URL (including the clear text key) under specific configuration conditions (affects up to version 3.3.1 when the automatic chain saving is active and the administrator's locale is a published secondary language). CVE-2026-19598 (CVSS 9.8) - in Pods, a privilege climbing failure that allows an unauthenticated attacker to become Administrator or overwrite passwords from any account (affects versions up to 3.3.9). CVE-2026-82222 (CVSS 10.0) - in GiveWP, a chain of failures (a broken "safe unserialize", a donation flow that inserts data controlled by the attacker and a chain of gadgets into the code) that culminates in the execution of arbitrary commands on servers that have at least one published donation form and an active payment gateway (affects versions up to 4.16.7.1).

How they work technically, in general terms: several of these failures take advantage of two recurring patterns in PHP applications and WordPress integrations. The first is confidence in entry points that support non-authenticated data (e.g. public flows such as SSO forms or endpoints) and the lack of appropriate validation / filtering. The second is the unsafe deerialization: when an application reads serialized data from the database or from user entries and unpipettes with functions that enable PHP objects to be rebuilt, an attacker can inject manipulated objects that, combined with "gadgets" (methods present in loaded classes that perform actions during the deerialization), result in code execution. Patchstack describes exactly this pattern in GiveWP (serialized objects that are not cleaned and development bookstores that offer gadget chains).

Those affected: WordPress administrators, site owners who use these plugins / themes and hosting providers who host WordPress sites. Not all sites with these extensions are equally at risk: many vulnerabilities require specific conditions (e.g., that the WPMU Hub SSO is mapped to an administrator, or that Fusion Builder is installed and active). However, given the popularity of Avada, TranslatePress and GiveWP, the absolute number of facilities at risk can be high.

Possible real consequences: in cases of greater severity (CERs or escalation to administrator) the attacker can install back doors, crypto-miners, modify content or defacture the site, use the server to dive to other networks, steal user data or process fraudulent payments. The CVSS 10.0 in GiveWP indicates the potential for Total server commitment when the factors described are aligned. In addition, the exposure of password restoration links in TranslatePress facilitates account hijacking without the need to exploit more security layers.

Distinguish the confirmed from the uncertain: it is confirmed that there are vulnerabilities with the indicated CVE and affections; the basic technical details have been described by the analysers (Wordfence and Patchstack). What is not confirmed in the initial information is whether they are already being actively exploited in the mass in actual attacks and how many sites have been compromised; this information is usually later reported in follow-up reports or in vendor notices.

Concrete and immediate measures you should take (owner or technical manager of a WordPress site):

1) Verify versions and install patches: check on the administration panel or via WP-CLI the installed versions of WPMU DEV Dashboard, Avada (and Fusion Builder), TranslatePress, Pods and GiveWP. If there are updates published by the suppliers, apply them immediately. If an extension is within the range indicated as affected (e.g. "up to and including X"), update to the later version. Update from WP admin: "Plugins → Updates" or using wp plugin update < slug > / wp theme update < slug >.

2) If you cannot update, temporarily disable: disable the plugins / vulnerable issues until it can apply patches. For production sites where this is not possible, take complementary mitigation (see following points).

3) Vulnerability-specific mitigation: for WPMU DEV, review the Hub SSO configuration and remove the map directly to administrative accounts if not required; for Avada, disable or remove Fusion Builder if not necessary; for TranslatePress, disable the automatic chain storage and temporarily change the location of the administrator to the main language to the patch; for GiveWP, review donation forms and active walkways and consider disabling the runway or plugin if it cannot update.

(4) Post-commitment containment and mediation: if you suspect that a site has been compromised, put the site in maintenance, change all administrative passwords (ideally from a safe environment or by reinstalling users), take active sessions, restore from a clean pre-commitment backup and scan with specialized tools (Wordfence, Sucuri, or incident response services). Audit access records and errors for operating patterns.

5) Increase additional barriers: implement WAF (web application firewall) rules to block known operating patterns, limit file and user permissions on the server, and keep backup out of the production environment. Consider disabling the deerialization of unreliable data and avoid development bookstores in production.

(6) Monitoring and audit: activate file integrity alerts, review user changes with privileges and enable audit records. Stay informed through the security publications of suppliers and equipment such as Wordfence and Patchstack.

Useful resources for deepening: WordPress security guides and documentation on deerialization and insecurity in PHP are recommended readings to understand these kinds of failures and how to mitigate them: https: / / develop.wordpress.org / plugins / security / and OWASP's explanation of Insecure Deserialization: https: / / owasp.org / www-community / vulnerabilities / Insecure _ Deserialization. To follow the specific notices, see the technical analysis and vulnerability lists at sites like Wordfence and Patchstack.

Conclusion: These vulnerabilities combine classic vectors (poorly configured SSO, file writing from public flows, tokens exposure, and unsafe deerialization) with consequences ranging from the kidnapping of administrative accounts to remote code execution. To act quickly - update or deactivate, apply specific mitigation and audit if there was intrusion - is the most effective way to reduce risk while suppliers and the community publish complete patches and countermeasures.