Five severe vulnerabilities in popular WordPress plugins and themes have been uncovered, potentially opening the door for unauthenticated attackers to gain admin access, inject arbitrary code, or even take over entire sites. Discovered by Wordfence and Patchstack, these weaknesses affect the WPMU DEV Dashboard, Avada theme, TranslatePress, Pods, and GiveWP, each with implications for site security depending on how they’re configured and used.‡
Breakdown of the Vulnerabilities
The WPMU DEV Dashboard plugin (version ≤ 5.0.1) has an authentication bypass bug under specific conditions. Sites using Hub Single-Sign-On (SSO) with WPMU DEV, where the SSO is mapped to an administrator account, are vulnerable to attackers gaining full admin access without proper credentials.‡
In the Avada theme (version ≤ 7.16 and Fusion Builder plugin ≤ 3.16), there’s an issue that allows arbitrary file writing. If attacked, this vulnerability enables uploading malicious files, which can be executed—culminating in remote code execution (RCE) and complete site compromise.‡
TranslatePress (≤ 3.3.1), when automatic string saving is active and the admin’s profile locale is set to a secondary published language, leaks the raw password-reset URL—including both the plaintext reset key and login parameters. This exposure can facilitate full administrator takeover.‡
The Pods plugin (≤ 3.3.9) contains a privilege escalation flaw allowing an unauthenticated attacker to become an administrator or change any user’s password—including that of the site owner. This flaw could be leveraged for total site takeover.‡
Most severe of all is the flaw in GiveWP (≤ 4.16.7.1), which allows arbitrary command execution on the server. It requires just a published donation form and an active payment gateway to exploit. The issue arises from a dangerous combination of a broken “safe unserialize” helper, attacker-controlled data fed through the donation flow, and a loaded gadget chain, enabling PHP object injection leading to RCE.‡
Why These Matter
All the flaws carry CVSS scores of 9.8 or 10.0, signaling extremely high severity. Because these plugins and themes are widely used across thousands of WordPress sites, any site with the affected versions—and specific configurations in some cases—faces serious risk. Site takeovers mean hackers could deface content, steal user data, monetize traffic, or push malware. RCE issues are especially dangerous, enabling full control over server environments.‡
Understanding how these vulnerabilities work highlights recurring issues: letting unsafe unserialization happen, storing attacker-controlled serialized objects, using development libraries in production, and assuming safe sanitization of input. Several also require specific settings—like locale or SSO configuration—that administrators might not even know are exposing them.‡
What Site Owners Should Do Immediately
- Upgrade the affected plugins and themes: WPMU DEV Dashboard, Avada (with Fusion Builder), TranslatePress, Pods, and GiveWP to fixed versions that patch these issues.
- Audit site configurations. Turn off automatic string saving if unused, ensure locale settings for admin profiles are restricted, verify SSO mappings, and double-check use of “safe unserialize” helpers or similar functions.
- Limit use of development-only libraries or gadget chains in production environments to avoid giving attackers prebuilt paths to exploit vulnerabilities.
- Use security plugins or services to scan for these CVEs explicitly and monitor for abnormal behavior or unauthorized file changes.
Despite growing awareness, WordPress continues to be a prime target for attackers due to its popularity and extensibility. Themes and plugins—especially those with deep hooks and elevated permissions—are frequent attack surfaces. These flaws underscore how even well-maintained sites can be exposed if feature choices or plugin combinations aren’t scrutinized.‡
What to watch: Keep an eye on official patch releases for each affected product. Ensure auditing of third-party extensions becomes part of routine site maintenance. And especially important: community vulnerability reports—when used proactively—are essential to defending the WordPress ecosystem at large.
