InfoSecBulletin Cybersecurity for mankind
Many serious security flaws have been found in WordPress plugins and themes, such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These issues could let hackers bypass login, take over accounts, and run any code.
The vulnerabilities, according to Wordfence and Patchstack, are listed below:
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
CVE-2026-76581 (CVSS score: 9.8): An authentication problem in the WPMU DEV Dashboard plugin might let an attacker without an account get into websites linked to WPMU DEV with Hub Single-Sign On (SSO) turned on and connected to an admin. This could let them gain admin access and take over the site. (Affects all versions up to and including 5.0.1)
CVE-2026-18431 (CVSS score: 9.8): An arbitrary file write issue in the Avada theme for WordPress lets a hacker without access write their own files to the server. This can be used to make and run unsafe PHP files, leading to remote code execution and full site takeover. (Affects all versions up to and including 7.16, when the Fusion Builder plugin is active in versions up to and including 3.16)
CVE-2026-19632 (CVSS score: 9.8): A flaw in the “TranslatePress – Translate Multilingual sites with AI Translation” plugin can let a hacker without an account get the main password-reset link. This includes the plain reset key and login details, which can let the hacker take over the admin account. (This affects all versions up to 3.3.1 only when automatic string saving is on and the admin’s profile language is a published secondary language)
CVE-2026-19598 (CVSS score: 9.8): The flaw in the “Pods – Custom Content Types and Fields” plugin lets an attacker without an account gain Administrator rights or change any user’s password, even the owner’s, leading to a full site takeover. (Affects all versions up to, and including, 3.3.9)
CVE-2026-82222 (CVSS score: 10.0): A flaw in the GiveWP plugin lets a hacker run any commands on the server of a GiveWP site with one published donation form and one active payment option. (Affects all versions up to, and including, 4.16.7.1)
“The flaw chains a broken ‘safe unserialize’ helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP ships,” Patchstack said about CVE-2026-82222. “This case shows how PHP object injection turns into remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes.”
“The root causes are common: trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if it were trusted, and shipping development-only libraries into production where they provide ready-made gadget chains.”
