The issues were identified by security researchers at Wordfence and Patchstack, with the most severe being an authentication bypass flaw tracked as CVE-2026-76581 (CVSS score: 9.8). This particular vulnerability affects the WPMU DEV Dashboard plugin and could allow an unauthenticated attacker to log in as an administrator if certain conditions are met.

Additional critical flaws were found in the other components:

• Avada (theme): A flaw that could allow authenticated attackers with subscriber-level access to execute arbitrary PHP code.
• TranslatePress (plugin): A vulnerability enabling account takeover via insufficient validation of user-supplied data.
• Pods (plugin): An issue that could lead to privilege escalation, allowing lower-privileged users to escalate their access.
• GiveWP (plugin): A flaw that could permit authenticated attackers to upload malicious files, leading to remote code execution.

Given the severity of these vulnerabilities, administrators are strongly advised to update all affected plugins and themes to their latest patched versions immediately. Additionally, it is recommended to:

• Review user roles and permissions to ensure no unauthorized privilege escalation has occurred.
• Audit site logs for any suspicious login activity or file uploads.
• Enable a Web Application Firewall (WAF) to help mitigate exploitation attempts.

These vulnerabilities are particularly dangerous because WordPress powers a substantial portion of the web, making it a prime target for automated attacks.

Source: The Hacker News

Are any of you currently running WPMU DEV Dashboard or Avada, and if so, what steps are you taking to verify your sites haven't been compromised before patching?