Search
Find merged stories by title or summary.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in
Critical WPMU DEV Dashboard Flaw Can Lead to WordPress Remote Code Execution
A critical authentication bypass vulnerability in the WPMU DEV Dashboard plugin could allow unauthenticated attackers to obtain administrator access to vulnerable WordPress sites and potentially execute arbitrary code. Tracked as CVE-2026-76581 , the flaw has a CVSS score of 9. 8 and affects WPMU DEV Dashboard versions 5. 0. 1 and earlier. The plugin, used on an estimated 350,000 WordPress sites, has been patched in version 5. 0. 2. The vulnerability was discovered by Wordfence researcher Alex Thomas on August 19 during internal research aided by the company’s Argus vulnerability-discovery system. Critical WPMU DEV Dashboard Flaw Exploitation requires the target WordPress site to be connected to WPMU DEV, have Hub Single Sign-On enabled, and map the Hub SSO account to a WordPress administrator.
You've reached the end of current stories for this search.