- Published on
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
- Authors
- Name
- DeepHorus
Five critical security vulnerabilities have been disclosed across popular WordPress plugins and themes, creating severe risks for website administrators. The flaws, affecting WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, could enable complete site takeover or remote code execution (RCE). Security firms Wordfence and Patchstack released the findings, urging immediate updates to mitigate the threats.
The vulnerabilities carry exceptionally high CVSS scores, with four rated 9.8 and the most severe, in GiveWP, scored at a perfect 10.0. The flaws affect specific versions of the software, including WPMU DEV Dashboard up to 5.0.1, Avada theme up to 7.16, TranslatePress up to 3.3.1, Pods up to 3.3.9, and GiveWP up to 4.16.7.1. In many cases, unauthenticated attackers can exploit the issues without any prior access.
The technical details highlight dangerous attack vectors. An authentication bypass in WPMU DEV Dashboard could grant administrator access via Hub Single-Sign On. An arbitrary file write in Avada allows attackers to execute malicious PHP files. The TranslatePress flaw leaks sensitive password-reset URLs, while a privilege escalation in Pods lets attackers overwrite any user password.
Most critical is the GiveWP vulnerability, which chains a broken serialization function with a gadget chain to execute arbitrary commands on the server. Patchstack noted the root causes include trusting flawed sanitizers and shipping development-only code into production. These flaws demonstrate how multiple security oversights can combine to create catastrophic compromises.
Website administrators using these plugins or themes must prioritize updating to the patched versions immediately. The combined risk of authentication bypass, privilege escalation, and remote code execution represents a significant threat to the WordPress ecosystem. Site owners should verify their installations and apply all available security patches without delay.
The disclosure underscores ongoing security challenges in third-party software dependencies. Developers are reminded to rigorously audit code for serialization flaws and avoid including unsafe libraries. As the WordPress platform powers millions of sites, such vulnerabilities have a wide potential impact across the internet.
