Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Multiple critical vulnerabilities were disclosed in several widely used WordPress plugins and themes—WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP—potentially allowing unauthenticated attackers to bypass authentication, perform arbitrary file writes and remote code execution, expose administrator password-reset data for account takeover, or escalate privileges to administrator. The report lists CVE IDs and high CVSS scores (9.8–10.0), affected versions, and technical commentary from Wordfence and Patchstack highlighting root causes such as unsafe unserialize usage and shipped development libraries that enable gadget chains.