Affected Systems

WPMU DEV Dashboard plugin ≤5.0.1 (CVE-2026-76581), Avada theme ≤7.16 with Fusion Builder ≤3.16 (CVE-2026-18431), TranslatePress ≤3.3.1 with specific config (CVE-2026-19632), Pods plugin ≤3.3.9 (CVE-2026-19598), GiveWP plugin ≤4.16.7.1 (CVE-2026-82222). Affects WordPress sites using these widely-deployed plugins and themes.

Exploitation Status

No active exploitation mentioned. Vulnerabilities publicly disclosed by Wordfence and Patchstack. Technical details available including gadget chain analysis for CVE-2026-82222. PoC development likely imminent given detailed public disclosure.

Business Impact

All five vulnerabilities allow unauthenticated attackers to achieve complete site takeover or remote code execution. CVE-2026-76581 enables admin access on WPMU DEV sites with Hub SSO enabled. CVE-2026-18431 permits arbitrary PHP file upload/execution. CVE-2026-19632 exposes password reset tokens for admin takeover. CVE-2026-19598 allows privilege escalation to administrator. CVE-2026-82222 (CVSS 10.0) enables RCE via PHP object injection on sites with active donation forms. These plugins/themes have significant install bases across WordPress ecosystem.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately update WPMU DEV Dashboard to version >5.0.1, Avada theme to >7.16 and Fusion Builder to >3.16, TranslatePress to >3.3.1, Pods to >3.3.9, and GiveWP to >4.16.7.1
  • For WPMU DEV sites: audit administrator accounts for unauthorized access, review Hub SSO configuration and disable if not required, check WordPress admin activity logs for suspicious logins since plugin installation
  • For Avada sites: scan web server for unauthorized PHP files in wp-content/uploads and theme directories, review web server access logs for POST requests to Fusion Builder endpoints
  • For GiveWP sites: review donation form submissions and payment gateway logs for anomalous serialized data, scan for webshells and check running processes for unauthorized commands
  • Deploy WordPress firewall rules blocking unauthenticated access to vulnerable plugin endpoints until patches are applied, monitor for CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, and CVE-2026-82222 exploitation attempts