Five Critical WordPress Plugin Flaws Hit in One Week

Five critical WordPress plugin flaws were disclosed in a single week, in five completely unrelated products. All five let an attacker in without a password. If your organisation runs a WordPress site, that’s a useful prompt to check something most businesses never look at directly: exactly which plugins and themes are installed, and what they can each do to your database. Here’s what happened, and the checklist worth running on your own site, whether or not you use any of the five.

The five critical WordPress plugin flaws, in plain terms

WPMU DEV Dashboard manages WordPress sites remotely. Its login process could be tricked into handing out an administrator session. Avada, a popular premium theme, and its Fusion Builder companion plugin let an attacker write a file to the server and run it, again without logging in. TranslatePress, a translation plugin, could be made to leak an admin’s password-reset link to anyone who asked. Pods, a plugin for building custom fields, had an admin request handler where the login check silently failed instead of blocking the request. GiveWP, a donation plugin, could be tricked into running commands on the server through a crafted donation submission.

All five have vendor patches out now: WPMU DEV Dashboard 5.0.2, Avada 7.16.1 with Fusion Builder 3.16.1, TranslatePress 3.3.2, Pods 3.3.9.1, and GiveWP 4.16.7.2. If any of these five are running anywhere on your web estate, update today. Don’t wait for the next scheduled maintenance window.

The checklist that matters beyond these five

These particular critical WordPress plugin flaws will be patched within a news cycle. The habits that let them through are the real, recurring risk. They’re worth checking on your own site this week.

Know what’s actually installed. Log into wp-admin and look at Plugins and Appearance, not just the ones you remember choosing. Sites accumulate plugins from old projects, agency handovers and one-off features nobody ever removed. That’s a large part of how attackers find weaknesses on WordPress sites in the first place. A plugin doesn’t need to be active in your memory to be active on your server.

Check the themes too. The Avada flaw is a reminder that a theme is not just styling. It’s code with the same access as a plugin. Fusion Builder shipped bundled inside Avada, so an update prompt for the theme alone would have missed it. That’s much the same pattern behind a bundled form plugin’s earlier site takeovers. If your theme includes a page builder or form tool, treat that bundled component as its own thing to patch.

Reduce what a single account can reach

Turn on automatic updates for anything that isn’t business-critical. Most of these five bugs were fixed within days of disclosure. Auto-update for minor and security releases closes that window without anyone having to remember to do it. That matters because vulnerability management is a standing decision, not a one-off scan.

Separate your admin accounts from your day-to-day accounts. Several of this week’s bugs end in an attacker gaining administrator access. If your WordPress admin account is also the one used for editing content daily, an attacker who lands it gets everything at once. A dedicated admin login limits the damage instead. Use it rarely, and protect it with a strong, unique password.

Ask who is watching for this. A security plugin that flags outdated components does this automatically. So does a managed hosting provider that patches on your behalf. Either way, nobody in-house has to track five separate vendor advisories a week. If nobody currently owns that job, that’s the gap this story points at.

Check what each plugin can actually reach before you decide it doesn’t matter. A donation plugin like GiveWP touches payment and personal data. A translation plugin like TranslatePress sits close enough to account recovery to leak a reset link. Neither looks like a high-risk component from the outside. Both turned out to be exactly that. When deciding which plugins deserve closer attention, ask what data or account access each one touches, not just how important its visible function seems.

If you think you might already be affected

None of the five vendors have reported evidence of widespread exploitation of these critical WordPress plugin flaws before the patches shipped. That’s the best-case outcome for a critical bug: it was fixed before attackers caught up. Still, if any of these plugins ran unpatched on your site for more than a few days after the fixes went out (24 August for WPMU DEV, 27 to 28 August for the rest), check your access logs for unfamiliar admin logins or new user accounts you didn’t create. Reset admin passwords as routine precaution, rather than waiting for a specific sign of trouble.

Why this keeps happening

WordPress core itself is patched quickly and rarely carries bugs this severe. The plugin and theme ecosystem is a different story. Tens of thousands of independent developers each write their own authentication and validation code, and each one can get a detail wrong that core would have handled correctly. Two of this week’s five bugs were actually found by an AI-assisted research tool that a security vendor has been running against popular plugins. That suggests more critical WordPress plugin flaws are coming, not fewer. Treat plugin and theme review as an ongoing task, not a one-off response to a bad headline.