> TritonInfoSec News
Home / Aug 31, 2026 / Story
0
#3 The Hacker News general August 29, 2026 at 16:25 UTC

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

By [email protected] (The Hacker News)

AI Summary

Critical vulnerabilities were disclosed across five widely-used WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — with flaws including CVE-2026-76581 (CVSS 9.8), an authentication bypass enabling full site takeover, as well as additional RCE vulnerabilities reported by Wordfence and Patchstack. These flaws collectively put millions of WordPress installations at risk of unauthenticated account takeover and arbitrary code execution. WordPress administrators should apply available patches immediately and audit for signs of exploitation.

Read full article → https://thehackernews.com/2026/08/five-critical-wo…

Relevance score: 85.0/100

# More from August 31

  1. 1
    Chrome Web Store extensions caught stealing crypto, browser data BleepingComputer
  2. 2
    TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor The Hacker News
  3. 4
    Anthropic warns infostealer malware is hijacking Claude sessions to drain usage BleepingComputer
  4. 5
    FulcrumSec claims Manchester Airports hack, theft of 86 GB of data BleepingComputer
  5. 6
    Hasbro Data Breach Exposed Employee Personal Information SecurityWeek
  6. 7
    I asked 100 companies for my data. Some deleted it instead. Ars Technica Security
  7. 8
    Brave browser adds email aliases to help users evade tracking BleepingComputer
  8. 9
    A 12TB Steam “teraleak” spills more than a decade of lost PC gaming history Ars Technica Security
  9. 10
    Anthropic is cutting Claude Code's current weekly limits by 17% BleepingComputer