CVE-2026-19598
CVSS 9.8 CRITICAL: the Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. EPSS 4% (89th percentile).
Vulnerabilities & Exploits · Web App Attack
Wordfence and Patchstack disclosed five critical flaws across WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, widening the Avada story from one zero-click remote code execution chain to multiple ways to take over a WordPress site. The set includes unauthenticated admin access, arbitrary file write, password-reset exposure, privilege escalation, and a server-side command execution path.
The mechanics differ, but the effect is the same: a mapped Hub single sign-on path can hand out administrator access, one Avada flaw can write attacker-controlled files that later run as PHP, TranslatePress can leak a raw administrator reset link, Pods can elevate an unauthenticated user to admin or overwrite passwords, and GiveWP can turn stored serialized data into command execution. In plain terms, one plugin layer can be enough to own the site even when the core CMS is untouched.
For public WordPress stacks, the exposure now sits across several independent extension paths, so fixing one plugin or one version line does not clear the whole estate. Sites that rely on these components inherit whichever takeover route their installed feature set leaves open, and the reporting still leaves the exact overlap of vulnerable configurations to each operator's environment.
2 sources · Aug 29
CVSS 9.8 CRITICAL: the Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. EPSS 4% (89th percentile).
CVSS 9.8 CRITICAL: the Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when… EPSS 0.9% (59th percentile).
CVSS 10 CRITICAL: deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue…
The Hacker News
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Critical flaws in WPMU DEV, Avada, TranslatePress, Pods, and GiveWP can enable admin takeover or remote code execution.
originalBleepingComputer
Critical Avada WordPress theme flaw enables zero-click RCE
A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server.
originalPart of the PlainSec briefing for 2026-08-29
Every edition of this story: WordPress Plugin Flaws Broaden Into Site Takeovers