Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

**Executive summary:** Five critical (CVSS 9.8–10.0) WordPress vulnerabilities affecting WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, and GiveWP—collectively installed on over one million sites—were disclosed in August 2026, enabling authentication bypass, remote code execution, information exposure, and privilege escalation; patches are available and site owners should prioritize immediate updates.