31 AUG 2026 — Five critical WordPress flaws were disclosed this week, four rated CVSS 9.8 and one at 10.0. What separates them from the usual advisory is that none of them requires an account.
The five
GiveWP carries CVE-2026-82222 at CVSS 10.0, a PHP object injection leading to arbitrary command execution, in versions up to 4.16.7.1. It was reported by Patchstack, and it applies where a site has at least one published donation form and an active payment gateway.
The other four came from Wordfence and all score 9.8. WPMU DEV Dashboard up to 5.0.1 has an authentication bypass giving an unauthenticated attacker administrator access. The Avada theme up to 7.16, with Fusion Builder 3.16 installed, allows an unauthenticated attacker to write arbitrary files to the server. TranslatePress up to 3.3.1 exposes password-reset URLs, permitting administrator account takeover. Pods up to 3.3.9 allows privilege escalation to administrator or overwriting any user's password.
Unauthenticated is the word that matters
Most WordPress advisories describe flaws reachable by a user who already has an account, often a contributor or subscriber. Those matter on sites with open registration and are largely theoretical elsewhere.
These are different: an authentication bypass that gives administrator access, or an arbitrary file write reachable without logging in, is exploitable by anyone on the internet. There is no precondition involving a compromised credential, no social engineering step, and no requirement that registration be open.
That is what a 9.8 describes, and it is why the large install-base numbers matter here in a way they usually do not.
Read the install figures as a ceiling, not an exposure
The reported counts — 400,000 sites for TranslatePress, 100,000 for Pods, a million sales for Avada — are the total population running that software, not the number that is vulnerable.
WordPress has had automatic background updates for plugins and themes for years, and a large share of sites will take the patched version without anyone doing anything. The vulnerable population is whatever remains: sites with auto-updates disabled, sites pinned to a version for compatibility, abandoned sites nobody administers, and sites where a managed host has its own update schedule.
Nobody publishes that number and it is the only one that describes real risk. The install base gets quoted because it is the only available figure, but the gap between installs and actual exposure is usually very large. Treating it as the exposure overstates the problem, and assuming auto-update handles everything understates it.
The CVSS 10.0 has preconditions worth reading
GiveWP scores a full 10.0, and the advisory notes it requires a published donation form and an active payment gateway.
These are not obscure conditions. They describe any site actually using the plugin to collect donations. So the preconditions narrow the population to the ones where the plugin matters, which is the opposite of reassuring.
It also describes a specific kind of organisation. Donation forms with live payment gateways sit on charity and nonprofit sites, which are among the least likely to have a patch management process, a security budget or anyone monitoring an advisory feed. A 10.0 in that population behaves worse than a 10.0 in an enterprise estate.
These are the classes CISA was describing
These five flaws are a roll-call of the weakness types that dominate real-world exploitation.
Arbitrary file write is improper input validation. Path handling in an object injection chain is the same family. Exposed password-reset URLs are sensitive information disclosure of the plainest kind. We reported that the most exploited flaw classes were all solved decades ago, with improper input validation topping both the exploited-vulnerabilities catalogue and the wider CVE record. This week's WordPress advisories are that finding restated in one ecosystem.
PHP object injection is the one class here specific to PHP. It arises when untrusted input reaches deserialisation, and the fix has been known for as long as the problem: do not deserialise data you did not create. It keeps appearing because deserialisation is a convenient way to pass structured data around, and convenience wins by default.
Where the research comes from
Four of the five were reported by Wordfence and the fifth by Patchstack, and both are commercial WordPress security vendors.
That is a point about incentives, not a disclosure problem. WordPress vulnerability research is substantially funded by companies selling WordPress security products, and the alternative is not disinterested academic research — it is nobody looking. The commercial incentive produces a steady stream of findings that would otherwise be found by attackers first.
The caveat is about emphasis, not accuracy. A vendor advisory reports a real flaw and has an interest in the severity being understood, and no reason to invent one. What it will not tell you is how many sites are actually exposed, because that number is not in its interest either.
What to do this week
Check versions rather than trusting auto-update, because the sites that need attention are precisely the ones where auto-update is off.
The five to look for are GiveWP above 4.16.7.1, WPMU DEV Dashboard above 5.0.1, Avada above 7.16 where Fusion Builder is installed, TranslatePress above 3.3.1 and Pods above 3.3.9. None is reported as actively exploited at the time of disclosure, which is the useful window and it does not last. GeoServer was probed within hours of a disclosure that had no CVE at all, and these have identifiers, published scores and a large addressable population.
View author profile → · Editorial policy
