Filtered by tag: site takeover × Clear
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Matched: WordPress
A critical authentication bypass (CVE-2026-76581, CVSS 9.8) was found in WPMU DEV Dashboard, a WordPress plugin with ~350,000 installations. When Hub SSO is enabled, unauthenticated attackers can exploit inconsistent HMAC construction across two SSO steps to gain administrator access and potentially execute remote code. The flaw was patched in version 5.0.2, released August 24, 2026. Users unable to update should disable Hub SSO immediately.
100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin
Matched: WordPress
A critical unauthenticated privilege escalation vulnerability was found in the Pods WordPress plugin, active on over 100,000 sites. Reported August 10, 2026, the flaw lets attackers gain administrator access without credentials, enabling actions like overwriting any user's password, including the site owner's, leading to full site takeover.