Six critical, no-login-required vulnerabilities hit popular plugins and themes this issue, including a perfect CVSS 10 score in the fundraising plugin GiveWP. Wordfence’s new AI research agent, Argus, had a hand in finding two of them. Away from security, WP Rocket published a blunt post-mortem on last week’s outage, and WordPress made real progress on two long-standing gaps: encrypted credential storage and a way to run any version of WordPress in your browser.

Security: Six Critical Flaws, Zero Logins Needed

GiveWP, a fundraising plugin used by nonprofits on more than 100,000 sites, had an unauthenticated flaw rated CVSS 10, the maximum possible score. Researcher Udin Chan reported it to Patchstack on July 28. The plugin exposed an unauthenticated account-registration action that ignored WordPress’s own registration setting, and a flaw in its safeUnserialize() helper let an attacker slip malicious serialized data into the database, which chained into a path for running commands on the server. On a default install with a published donation form and an active payment gateway, no account was needed at all. GiveWP shipped a fix in version 4.16.7.2 on August 27, closing the chain at multiple points and running a database migration to scrub any malicious data already stored. Update immediately if you run GiveWP.

The Avada theme, sold on ThemeForest with over a million copies, had a critical unauthenticated remote code execution flaw in its Fusion Patcher component. Wordfence rated it 9.8 and found the six-step exploit chain using Argus, a new AI agent the company built specifically for deep, multi-step vulnerability hunting. Update to Avada 7.16.1 and Fusion Builder 3.16.1.

Argus had a second find this week: WPMU DEV Dashboard, installed on an estimated 350,000 sites, had a critical authentication bypass that let an attacker become administrator whenever Hub Single Sign-On was enabled. WPMU DEV patched it in version 5.0.2, five days after Wordfence’s report.

Three more critical flaws rounded out the week. The Pods plugin, used on 100,000+ sites, had a 9.8-rated bug that let an unauthenticated attacker overwrite any user’s password, including the site owner’s; update to 3.3.9.1. TranslatePress, running on 400,000+ multilingual sites, could hand an attacker an admin’s password reset link if that admin’s profile was set to a secondary language. And miniOrange SAML SSO had two forged-login flaws that mostly hit paying customers, whose separate version-numbering scheme let vulnerability scanners wrongly mark them as already patched.

Performance: WP Rocket’s Post-Mortem

WP Rocket published a post-mortem on the fatal errors that took sites offline after WordPress 7.1 shipped last week. The company now estimates 10% of its sites went down, out of roughly 27% that were at risk. The uncomfortable part: a bug report describing the exact issue, with a suggested one-line fix, sat on GitHub for six weeks before the crash, reviewed the day it was filed but never assigned to anyone.

WP Rocket VP of Engineering Mathieu Lamiot said every GitHub report will now get an assigned owner, the compatibility test suite is being rebuilt around the plugins its users actually run, and the Cloudflare module responsible for the crash will now be gated so it only loads on sites that use Cloudflare. If you’re already on WP Rocket 3.23.2.2 or later, you’re protected from this specific bug.

Platform: Secrets, Old Versions, and Accessibility Testing

WordPress took a real step toward killing plaintext API keys. A new proposal targets a Secrets API for WordPress 7.2, with mandatory encryption and no plain-text option, so plugins stop writing API keys straight into the same database table as your site tagline. There’s no admin screen yet; that’s deliberately deferred to version 7.3 so the storage layer can prove itself first.

Separately, WordPress Playground can now boot 55 different versions of WordPress directly in your browser, all the way back to version 0.7 from 2003. It’s a genuinely useful way to check whether an old plugin still works, or see how a legacy site behaved, without keeping ancient PHP installs around.

And the WordPress Accessibility Team previewed its first official plugin, a prototype called Accessibility Lab that flags skipped heading levels and runs real-time accessibility checks on blocks as you edit. It’s not installable yet, but it’s a sign the team is building real tooling rather than just guidelines.

AI: WordPress Signs the Open Weights Letter

WordPress added its name to a letter asking US policymakers not to place early restrictions on open weight AI models, joining more than 270 signatories that now include Automattic and GoDaddy. WordPress Executive Director Mary Hubbard framed the ask as consistent with the project’s own open-source roots: software gets better and safer when more people can study and build on it. The letter, led by NVIDIA, asks for expanded compute access for researchers, investment in shared training tools, and no premature restrictions on open weight models.

End of article