Several critical security vulnerabilities have been identified in widely-used WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These flaws, carrying CVSS scores ranging from 9.8 to a maximum of 10.0, present severe risks such as unauthenticated remote code execution (RCE), authentication bypass, and full account takeover.
The vulnerabilities often stem from improper handling of data, such as insecure unserialization, broken sanitizers, and sensitive information exposure during password reset processes. Notably, the GiveWP flaw leverages a PHP object injection chain to achieve RCE, highlighting the danger of trusting serialized data and shipping development-only libraries in production environments.
Top comments (0)