← All postsAugust 31, 2026

A Bad Week for WordPress Plugins — What It Means for Your Site

Late this month, security researchers disclosed five separate critical vulnerabilities across popular WordPress plugins and a widely used theme — in the WPMU DEV Dashboard, the Avada theme (paired with Fusion Builder), the TranslatePress translation plugin, the Pods framework, and the GiveWP donation plugin. Several carry the maximum or near-maximum severity score (9.8–10.0 out of 10), and none of them require a username or password to exploit. If a site was running the vulnerable version, an attacker could simply find it and take it over.

I don't usually write about individual CVEs — most are narrow, low-severity, or already patched by the time anyone hears about them. This batch is worth flagging because of the combination: real reach (TranslatePress alone is active on 400,000+ sites, and Avada is one of the best-selling WordPress themes ever), real severity (full admin takeover or remote code execution, not just a glitch), and zero authentication required. Wordfence, the security firm that found and reported two of the five, has already published fixes; the vendors have patched versions out.

What actually matters here

Not the specific bug names — those will be forgotten in a month. What's worth taking from this:

  • "Set and forget" doesn't work for plugins. A theme or plugin that was safe on install can become a liability the moment a researcher (or an attacker) finds a new hole in it. Auto-updates for plugins and themes, not just WordPress core, are worth turning on unless you have a specific reason not to.
  • More plugins means more exposure. Every additional plugin or theme component is another piece of code that can carry a vulnerability like this one. It's worth periodically checking what's actually installed on your site and removing anything you're not using.
  • "Critical" and "unauthenticated" together is the combination to take seriously. A lot of WordPress security notices are minor. When a flaw needs no login and scores near the top of the severity scale, that's the one to patch same-day, not "next time I'm in there."
  • A web application firewall buys you time. It won't fix an unpatched plugin, but it can block many of these exploitation patterns while a patch gets applied.

If you're not sure what's running on your site

This is exactly the kind of thing that's easy to lose track of if you're not checking regularly — which version of which plugin, whether auto-updates are actually on, whether an old theme is still active in the background. If you want a second set of eyes on it, that's a quick thing to check.

Sources: