Five critical WordPress plugin flaws: the patch list

WordPress core has been quiet this month. The plugin and theme layer has not. Five separate critical WordPress plugin flaws landed in the last two weeks, four of them CVSS 9.8 and one a straight 10.0, and every one of them ends the same way: an unauthenticated attacker becomes an administrator or runs commands on your server. If a client site of yours runs any of these, the patch list below is your afternoon.

What actually happened

Five advisories, compiled from vendor and researcher disclosures and rounded up by The Hacker News on August 29:

• GiveWP — CVE-2026-82222, CVSS 10.0. Affects ≤ 4.16.7.1; fixed in 4.16.7.2, released August 27. BleepingComputer reports over 100,000 installs. The chain is ugly: a broken "safe unserialize" helper, a donation flow that feeds it attacker-controlled data, and a gadget chain in libraries GiveWP already bundles. Authentication is required — and GiveWP hands it out, because give_action=user_register never checks WordPress's users_can_register setting. Exploitable on any site with one published donation form and one active payment gateway. Reported by Udin Chan via Patchstack on July 28.
• WPMU DEV Dashboard — CVE-2026-76581, CVSS 9.8. Affects ≤ 5.0.1; fixed in 5.0.2, August 24. Authentication bypass to full admin on sites with Hub SSO enabled and mapped to an administrator. Found by Wordfence's Alex Thomas with the firm's Argus research system.
• Avada theme — CVE-2026-18431, CVSS 9.8. Affects Avada ≤ 7.16 with Fusion Builder ≤ 3.16; fixed in 7.16.1 / 3.16.1. Unauthenticated arbitrary file write, which means an attacker drops a PHP file and then requests it.
• TranslatePress — CVE-2026-19632, CVSS 9.8. Affects ≤ 3.3.1; fixed in 3.3.2, August 13. Leaks the raw administrator password-reset URL, plaintext key included.
• Pods — CVE-2026-19598, CVSS 9.8. Affects ≤ 3.3.9; fixed in 3.3.9.1, with backports at 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2 and 3.2.8.3. The pods_admin AJAX router routes access checks through a function that logs the failure and returns false instead of halting — so the nonce check, the login check and the capability gate all become suggestions.

Why it matters for your business

Notice the pattern. Not one of these is a core WordPress bug. They are a donation form, a hosting vendor's own dashboard, a page builder, a translation plugin, and a custom-fields plugin — exactly the layer that gets installed once during a build and then never audited again.

The Pods bug is the one worth reading twice, because the failure mode is architectural rather than exotic. Four independent security controls were stacked in front of an admin endpoint, and a single error handler that returned instead of exiting made all four decorative. Defense in depth does not work when every layer funnels through the same broken gate.

Practically: your plugin inventory is a security asset, and most small-business sites do not have one. Get a list of every active plugin and theme with its version, on every site you own. Compare it against the list above. Then decide who owns that list going forward — because the next round of advisories is roughly two weeks out, and it will hit a different five plugins.

For GiveWP specifically, patching is not the whole job. The fix strips stored malicious payloads from the database, which tells you the vendor expected some sites were already hit. If you run donations, check for administrator accounts you did not create.

Sources: The Hacker News — Five Critical WordPress Plugin and Theme Flaws, BleepingComputer — GiveWP flaw lets hackers execute server commands, Wordfence — Pods unauthenticated privilege escalation.