InfoSecBulletin Cybersecurity for mankind
Many serious security flaws have been found in WordPress plugins and themes, such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These issues could let hackers bypass login, take over accounts, and run any code.
The vulnerabilities, according to Wordfence and Patchstack, are listed below:
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
CVE-2026-76581 (CVSS score: 9.8): An authentication problem in the WPMU DEV Dashboard plugin might let an attacker without an account get into websites linked to WPMU DEV with Hub Single-Sign On (SSO) turned on and connected to an admin. This could let them gain admin access and take over the site. (Affects all versions up to and including 5.0.1)
CVE-2026-18431 (CVSS score: 9.8): An arbitrary file write issue in the Avada theme for WordPress lets a hacker without access write their own files to the server. This can be used to make and run unsafe PHP files, leading to remote code execution and full site takeover. (Affects all versions up to and including 7.16, when the Fusion Builder plugin is active in versions up to and including 3.16)
CVE-2026-19632 (CVSS score: 9.8): A flaw in the “TranslatePress – Translate Multilingual sites with AI Translation” plugin can let a hacker without an account get the main password-reset link. This includes the plain reset key and login details, which can let the hacker take over the admin account. (This affects all versions up to 3.3.1 only when automatic string saving is on and the admin’s profile language is a published secondary language)
CVE-2026-19598 (CVSS score: 9.8): The flaw in the “Pods – Custom Content Types and Fields” plugin lets an attacker without an account gain Administrator rights or change any user’s password, even the owner’s, leading to a full site takeover. (Affects all versions up to, and including, 3.3.9)
CVE-2026-82222 (CVSS score: 10.0): A flaw in the GiveWP plugin lets a hacker run any commands on the server of a GiveWP site with one published donation form and one active payment option. (Affects all versions up to, and including, 4.16.7.1)
“The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships,” Patchstack said about CVE-2026-82222. “This case shows how PHP object injection turns into remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes.”
“The root causes are common: trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.”
