Security researchers disclosed five unrelated critical vulnerabilities this week across some of WordPress's most widely installed plugins and themes, four of them scoring 9.8 or higher on the 10-point CVSS severity scale and one hitting the maximum 10.0. Between them, the affected products — the Avada theme, TranslatePress, the Pods content-type plugin, the WPMU DEV Dashboard, and the GiveWP donation plugin — run on hundreds of thousands of live WordPress sites, and the flaws range from authentication bypass to outright remote code execution.
The most severe is in GiveWP (CVE-2026-82222, CVSS 10.0): any site with one published donation form and an active payment gateway can be forced to run arbitrary commands on the server. The Avada theme (CVE-2026-18431, CVSS 9.8) lets an unauthenticated visitor chain a sequence of smaller flaws into writing a malicious PHP file to the server — a zero-click path to full compromise on sites running Avada up to version 7.16 with Fusion Builder active. TranslatePress (CVE-2026-19632) exposes admin password-reset links on multilingual sites with automatic string saving turned on, and researchers say roughly 400,000 sites are affected. The Pods plugin (CVE-2026-19598, on about 100,000 sites) lets an attacker escalate to administrator or overwrite any user's password outright. The WPMU DEV Dashboard flaw (CVE-2026-76581) allows authentication bypass to admin access on sites with Hub single sign-on enabled. Wordfence and Patchstack, the two researcher groups that found and disclosed the bugs, have published fixed versions for every one of them.
What this means for your business
- If your site runs any of Avada, TranslatePress, Pods, the WPMU DEV Dashboard, or GiveWP, update to the latest version today — all five have patches already available, and WordPress vulnerabilities are routinely mass-scanned by automated bots within days of a public disclosure like this one.
- Most business owners don't know the full list of plugins and themes running on their own site — ask whoever built or maintains it (an agency, a freelancer, or your in-house team) to confirm what's installed and that everything is on a current, supported version, not just WordPress core itself.
- A CVSS 9.8-plus score means an attacker doesn't need a password or any special access to exploit it — that's what separates "patch this eventually" from "patch this before you do anything else today."
- If you accept donations or payments through GiveWP, or run a multilingual site with TranslatePress, treat those two as the most urgent: both have a direct path to a fully compromised server or a hijacked admin account.
No active exploitation of these specific flaws has been confirmed yet, but that window closes fast once a CVSS 9.8+ WordPress bug goes public. Patching this week, rather than waiting for a "we'll get to it" maintenance cycle, is the difference between a routine update and an incident response call.