Security researchers have disclosed five critical vulnerabilities in widely used WordPress plugins and themes. The flaws, identified by Wordfence and Patchstack researchers, include an authentication bypass vulnerability in WPMU DEV Dashboard and other issues across Avada, TranslatePress, Pods, and GiveWP. Successful exploitation could allow attackers to gain administrative access, take over websites, or execute arbitrary code. Vendor patches and updates are available; users are advised to update affected plugins and themes immediately.

Which products are affected?

WPMU DEV Dashboard, Avada, TranslatePress, Pods, GiveWP

What should defenders do?

Users should immediately update all affected WordPress plugins and themes to their latest available versions. Enable web application firewall rules to block known exploitation patterns. Monitor Wordfence and Patchstack advisories for vendor-specific patches and detailed mitigation guidance. Apply the principle of least privilege to user accounts and regularly audit plugin and theme permissions.

criticalVulnerability

Five Critical WordPress Plugin and Theme Vulnerabilities Disclosed

Authentication bypass, account takeover, and remote code execution flaws affect popular plugins and themes

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Five Critical WordPress Plugin and Theme Vulnerabilities Disclosed

Key Takeaways

Five critical vulnerabilities disclosed in WordPress plugins and themes by Wordfence and Patchstack researchers.
CVE-2026-76581 in WPMU DEV Dashboard has a CVSS score of 9.8, indicating severe risk.
Flaws across Avada, TranslatePress, Pods, and GiveWP could allow authentication bypass, account takeover, and arbitrary code execution.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read