The messy list: five flaws you should not ignore

Researchers at Wordfence and Patchstack found a grab bag of nasty bugs in popular WordPress plugins and a theme. These flaws range from site takeover shortcuts to full-on RCE nightmares — meaning attackers could escalate privileges, reset admin accounts, write files, or run arbitrary code if a site is running the affected software.

  • CVE-2026-76581 — WPMU DEV Dashboard: An authentication bypass that can let unauthenticated actors gain administrator access on sites using Hub single-sign-on mapped to an admin user. Affects versions up to and including 5.0.1.

  • CVE-2026-18431 — Avada (with Fusion Builder): An unauthenticated arbitrary file write issue that can be chained to create and execute PHP files on the server, resulting in complete compromise. Affects Avada up to 7.16 when the Fusion Builder plugin (up to 3.16) is present and active.

  • CVE-2026-19632 — TranslatePress: A sensitive data exposure flaw that can leak the raw admin password-reset URL (including the reset key and login parameters), enabling full account takeover under a specific configuration (automatic string saving enabled and target admin profile set to a published secondary language). Affects versions up to and including 3.3.1 under those conditions.

  • CVE-2026-19598 — Pods: An unauthenticated privilege escalation that allows attackers to become administrators or overwrite any user password, including the site owner’s, leading to total control. Affects versions up to and including 3.3.9.

  • CVE-2026-82222 — GiveWP: A severe PHP object injection chain that can turn into remote command execution when a site has one published donation form and one active payment gateway. The issue combines an unsafe unserialize helper, a donation flow that accepts attacker-controlled data, and a usable gadget chain in shipped code. Affects versions up to and including 4.16.7.1.

Quick, sensible steps to survive this mess

No panic — just a brisk, focused cleanup. Do these things right away:

  1. Update any affected plugin or theme immediately. If a patch is available, apply it now.

  2. If you can’t patch, deactivate and remove the vulnerable plugin/theme until a fix is released.

  3. Audit admin users and sessions. Force password resets for high-risk accounts and review recent logins.

  4. Check any donation/payment forms (GiveWP) and payment gateway settings — remove or disable them if you suspect exposure.

  5. Disable risky features mentioned in advisories (for example, Hub SSO mappings or automatic string saving) until you confirm safety.

  6. Restore from a clean backup if you detect compromise, and rotate any leaked credentials or API keys.

  7. Harden your site: enable a web application firewall, keep full backups, and monitor logs for suspicious activity.

  8. Follow vendor advisories from Wordfence and Patchstack for technical details and mitigation steps.

Short version: these are high-impact bugs—update or remove affected components, check for signs of compromise, and keep backups. Treat them like a stubbed toe on a server: annoying, slightly painful, and better fixed before it gets infected.