Critical bugs in popular plugins. Updates can't wait.
Flaws that let attackers take over sites were found in widely used WordPress add-ons. Sites that update quickly and keep backups are safe; others are exposed.
By the Xuru Technologies team · 2 September 2026
Key takeaways
- Maximum-severity flaws were flagged in GiveWP, WPMU DEV Dashboard and the Avada theme, including remote code execution and site takeover.
- A cyberattack disrupted Boston Scientific's global order processing, and Berlin's government confirmed data theft.
- A phishing kit abusing Microsoft 365 logins reportedly bypassed two-factor authentication at thousands of organisations.
WordPress runs a huge share of the web, which makes popular plugins attractive targets. When a critical flaw is published, attackers move within days.
What happened
DMARC Report's weekly round-up listed the plugin flaws alongside major incidents and newly exploited vulnerabilities added to CISA's catalogue. Details on some claims are still being confirmed.
What it means for website owners
- Plugins are the weak point. Each one adds risk.
- Speed matters. Update within days of a critical fix.
- Logins are targeted. Strong admin protection blocks takeovers.
Website security checklist
| Action | Frequency |
|---|---|
| Update core, plugins and theme | Weekly, or immediately for critical fixes. |
| Remove unused plugins | Quarterly. |
| Offsite backups | Daily. |
| Admin MFA and login limits | Always on. |
| Uptime and file-change monitoring | Continuous. |
Frequently asked questions
Which WordPress plugins had critical flaws in August 2026?Reports flagged GiveWP, WPMU DEV Dashboard and the Avada theme. Check your site and update to the latest versions.
Reports flagged GiveWP, WPMU DEV Dashboard and the Avada theme. Check your site and update to the latest versions.
How do I know if my site was hacked?Look for unknown admin users, unfamiliar pages, redirects or security plugin alerts, and check Google Search Console messages.
Look for unknown admin users, unfamiliar pages, redirects or security plugin alerts, and check Google Search Console messages.
Is automatic updating safe?For minor and security updates, usually yes, especially with daily backups so you can roll back if needed.
For minor and security updates, usually yes, especially with daily backups so you can roll back if needed.
Patched, backed up, watched.
WordPress maintenance, hardening and rescue for business websites.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply