Blog Avada 7.16.1 patches an RCE, and two plugins leaked reset links

Avada 7.16.1 patches an RCE, and two plugins leaked reset links

Avada 7.16.1 fixes an unauthenticated remote code execution chain that needed Fusion Builder active too. TranslatePress 3.3.2 and InfusedWoo Pro 5.1.18 both close holes that handed an administrator password reset link to an attacker.

Segurium 6 min read
  • wordpress
  • plugin
  • theme
  • cve

Two of the most-installed WordPress add-ons carry critical bugs, and both have a fix you can install today. Avada shipped 7.16.1 on 25 August. TranslatePress fixed its hole in 3.3.2, and the directory was already serving 3.3.4 hours before the report went public. Update both and you are done.

The day has a second story hiding inside it. Two unrelated plugins, from two unrelated vendors, both leaked an administrator’s password reset URL. TranslatePress saved it into a translation table. InfusedWoo Pro rendered it into an email preview. Neither vendor knew about the other. A reset link is a password with a shorter life. Both plugins gave one to someone who should never have seen it.

Four more plugin and theme issues follow. Two of those have no fix at all.

fusion-builder up to 3.16 with avada up to 7.16, patched in Avada 7.16.1

Fusion Builder ships as part of the Avada theme, which has sold around 1,000,000 licences. The bug is a chain of missing authorization checks across the theme and the plugin. An attacker with no account writes a file of their choosing onto the server. They write a PHP file, then request it, and the server runs it. That is full site compromise from the outside.

Three conditions have to be true at once. Avada must be 7.16 or older. Fusion Builder must be 3.16 or older, installed and active. And the site must already hold certain content an administrator wrote. If Fusion Builder is not active, the chain does not work.

ThemeFusion fixed it in Avada 7.16.1 on 25 August 2026. Their changelog names the component: a remote code execution flaw in the Fusion Patcher.

  • Affected: Avada up to 7.16 with Fusion Builder up to 3.16, both active.
  • Patched in Avada 7.16.1, released 25 August 2026.
  • CVE-2026-18431 — CWE-862 missing authorization, CVSS 9.8, no login needed.
  • Around 1,000,000 Avada licences sold. wordpress.org publishes no install count for themes, and Fusion Builder is not in the directory.
  • Update the theme first, then update the bundled plugins from the Avada update screen. Both halves have to move.
  • Cannot update today? Deactivate Fusion Builder. It breaks every Avada layout on the site, so this is a stopgap, not a fix.
  • After updating, check wp-content/uploads/ and the theme folder for PHP files nobody put there.

The record is not on NVD yet. The fix is described in Avada’s changelog.

translatepress-multilingual up to 3.3.1, patched in 3.3.2

TranslatePress runs on around 400,000 sites. In 3.3.1 and earlier, the trp_get_translations_regular AJAX action was registered on wp_ajax_nopriv_ as well as wp_ajax_. That one word is the whole bug. nopriv means logged out. Anyone could call it, and it returned dictionary rows by id.

What ends up in that dictionary is the problem. Automatic string saving is on by default. With it on, TranslatePress stores text it sees on a page as a translatable string. Now take an administrator whose profile language is one of your published secondary languages. Their own password reset page goes through that same path. So the reset URL, plaintext key and all, gets written into the secondary-language dictionary table. Then the open endpoint returns it to anyone who asks.

Version 3.3.2 makes two changes. It drops the nopriv registration, and it adds a current_user_can() check against the trp_translating_capability filter, which defaults to manage_options. Front-end translation moved to a separate get_translations_domchanges() handler that never returns dictionary row ids at all.

  • Affected: all versions up to and including 3.3.1.
  • Patched in 3.3.2. Current version is 3.3.4, published 25 August 2026.
  • CVE-2026-19632 — CWE-640, CVSS 9.8, no login needed.
  • Installed on ~400,000 sites.
  • Only exploitable when automatic string saving is on and an administrator profile uses a published secondary language.
  • Update, then force a password reset on every administrator. A leaked reset link stays useful until it is used or expires.
  • Still on 3.3.1 and unable to update? Turn off automatic string saving. That stops new reset links reaching the dictionary. It does not remove the ones already there.

The fix is visible in changeset 3645229. This record is not on NVD yet either.

total-donations up to 2.0.5, unpatched

Total Donations has two confirmed critical bugs, both CVSS 9.8, neither needing a login. The first is SQL injection. A user-supplied parameter is not escaped and the query is not prepared. An attacker appends their own SQL and reads the database (CVE-2026-78568). The second raises an anonymous visitor straight to administrator (CVE-2026-78570).

Neither record names a fixed version, and the plugin is not in the wordpress.org directory. There is nothing to update to.

  • Affected: all versions up to and including 2.0.5.
  • CVE-2026-78568 — SQL injection, CWE-89, CVSS 9.8, no login needed.
  • CVE-2026-78570 — privilege escalation to admin, CWE-269, CVSS 9.8, no login needed.
  • No install count is published for this plugin.
  • No fix is named in either record. Remove the plugin.
  • Then read your user list. A new administrator account you did not create is the thing to look for.

jawn up to 1.4.2, unpatched

Jawn is a commercial WordPress theme. In every version up to and including 1.4.2, an attacker with no account becomes an administrator (CVE-2026-78477, CVSS 9.8, CWE-266). The record describes the outcome and not the route, so there is no endpoint or parameter to name yet.

  • Affected: all versions up to and including 1.4.2.
  • CVE-2026-78477 — privilege escalation to admin, CVSS 9.8, no login needed.
  • wordpress.org publishes no install count for themes.
  • No fix is named in the record. Switch themes if one does not arrive.
  • Check your user list for administrators you did not create, and check when each one registered.

infusedwoo-pro up to 5.1.17, patched in 5.1.18

InfusedWoo Pro extends WooCommerce email tools. The ajax_iwar_preview_email() function used is_admin() as its only authorization check. That function does not do what its name suggests. is_admin() returns true for any request to the admin area, including an admin-ajax call from a subscriber. It is not a permission check and it never was.

So any logged-in user, subscriber and up, could render an email preview for an address they chose. The preview expands merge fields. One of those merge fields is the password reset link. Ask for a preview aimed at the administrator’s address. Read the link out of the result. The account is yours.

Infused Addons fixed it in 5.1.18 on 15 August 2026.

  • Affected: all versions up to and including 5.1.17.
  • Patched in 5.1.18, released 15 August 2026.
  • CVE-2026-19892 — CWE-862 missing authorization, CVSS 8.8.
  • Needs a login. Subscriber is enough.
  • No install count is published for this plugin.
  • Update, then force a password reset on administrator accounts.
  • Sites that allow open registration were reachable by anyone. Review accounts created since 15 August.

cm-map-locations up to 2.1.8, patched in 2.1.9

CM Map Locations 2.1.9 fixes an arbitrary file upload in its uploadMedia function (CVE-2026-16601, CWE-434, CVSS 8.8). The upload handler filtered extensions, but the filter was incomplete. It checked no MIME type and it verified no upload capability before calling move_uploaded_file(). So a subscriber could upload a file the server will execute.

The nonce that gates the cmloc_route_image_upload action was no obstacle. The plugin printed it into the CMLOC_Editor_Images JavaScript object. That object sits on the front-end location editor page, where any logged-in subscriber can read it.

Around 60 sites run this plugin. The fix has been out since July.

  • Affected: all versions up to and including 2.1.8. Patched in 2.1.9.
  • CVE-2026-16601 — limited arbitrary file upload, CVSS 8.8.
  • Installed on ~60 sites.
  • Needs a login. Subscriber is enough.
  • After updating, check wp-content/uploads/ for unexpected .php, .phtml and .htaccess files.

Four of these six have a fix. Two of those fixes were public before the report was. That gap is the normal shape of a WordPress security day. The patch exists, and the site still runs the old version. Reset links deserve a second pass, because updating a plugin does not invalidate a link that already leaked.

Related

Tags: #wordpress , #plugin , #theme , #cve