InfoSecBulletin Cybersecurity for mankind
Many serious security flaws have been found in WordPress plugins and themes, such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These issues could let hackers bypass login, take over accounts, and run any code.
The vulnerabilities, according to Wordfence and Patchstack, are listed below:
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
CVE-2026-76581 (CVSS score: 9.8): An authentication problem in the WPMU DEV Dashboard plugin might let an attacker without an account get into websites linked to WPMU DEV with Hub Single-Sign On (SSO) turned on and connected to an admin. This could let them gain admin access and take over the site. (Affects all versions up to and including 5.0.1)
CVE-2026-18431 (CVSS score: 9.8): An arbitrary file write issue in the Avada theme for WordPress lets a hacker without access write their own files to the server. This can be used to make and run unsafe PHP files, leading to remote code execution and full site takeover. (Affects all versions up to and including 7.16, when the Fusion Builder plugin is active in versions up to and including 3.16)
CVE-2026-19632 (CVSS score: 9.8): A flaw in the “TranslatePress – Translate Multilingual sites with AI Translation” plugin can let a hacker without an account get the main password-reset link. This includes the plain reset key and login details, which can let the hacker take over the admin account. (This affects all versions up to 3.3.1 only when automatic string saving is on and the admin’s profile language is a published secondary language)
CVE-2026-19598 (CVSS score: 9.8): The flaw in the “Pods – Custom Content Types and Fields” plugin lets an attacker without an account gain Administrator rights or change any user’s password, even the owner’s, leading to a full site takeover. (Affects all versions up to, and including, 3.3.9)
CVE-2026-82222 (CVSS score: 10.0): A flaw in the GiveWP plugin lets a hacker run any commands on the server of a GiveWP site with one published donation form and one active payment option. (Affects all versions up to, and including, 4.16.7.1)
“The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships,” Patchstack said about CVE-2026-82222. “This case shows how PHP object injection turns into remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes.”
“The root causes are common: trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.”
