Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Critical flaws in WPMU DEV, Avada, TranslatePress, Pods, and GiveWP can enable admin takeover or remote code execution.
More info