Security researchers at Wordfence have discovered a critical vulnerability chain in the Avada WordPress theme — one of the bestselling commercial themes with over a million sales — that allows an unauthenticated attacker to execute arbitrary PHP code on the server without any interaction from the site owner. The attack chains six separate weaknesses covering authorization, input validation, trust boundary, and file-handling flaws, all tracked together as CVE-2026-18431 with a 9.8 (Critical) CVSS score.
A successful exploit gives attackers full control of the affected website: they can plant malware, access databases, redirect visitors to malicious pages, or add rogue administrator accounts. The vulnerability was discovered internally by Wordfence’s AI-assisted “Argus” framework, which also built a proof-of-concept in about two hours. Wordfence reported the findings to ThemeFusion (Avada’s developer) on August 5; the developer released fixes on August 25. Wordfence is withholding full technical details to give site owners time to patch before exploit code becomes public.
How to check if you’re affected
Affected versions include Avada theme versions older than 7.16.1 and Fusion Builder plugin versions before 3.16.1. Both the theme and the plugin must be active for the exploit chain to work. Log in to your WordPress dashboard → Appearance → Themes, check the Avada version, and update to 7.16.1. Then go to Plugins → Installed Plugins, find Fusion Builder, and update to 3.16.1 or later.
Sources
- Critical Avada WordPress theme flaw enables zero-click RCE — BleepingComputer