Critical Avada WordPress theme flaw enables zero-click RCE

Summary

A critical vulnerability chain, CVE-2026-18431, affecting Avada theme and Fusion Builder plugin versions up to 7.16 and 3.16 respectively, allows unauthenticated attackers to achieve arbitrary PHP code execution. The exploit chains six distinct security issues, including authorization and input-validation flaws, to enable full website compromise for activities like malware deployment or credential theft. While patched, the complexity of the chain and specific version requirements may limit immediate widespread exploitation.

Full text

Critical Avada WordPress theme flaw enables zero-click RCE By Bill Toulas August 26, 2026 05:33 PM 0 A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server. The exploit chains six security issues into a zero-click attack. The flaws are collectively tracked as CVE-2026-18431 and received a 9.8 critical severity score. The attack comprises exploits for authorization, input-validation, trust-boundary, and file-handling weaknesses, which must be executed in a specific order to enable arbitrary PHP code execution on a target server. Hackers who successfully exploit these vulnerabilities could fully compromise websites for malicious activities ranging from planting malware and accessing databases to redirecting visitors to malicious sites or adding rogue admin accounts. CVE-2026-18431 affects Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16, researchers at Defiant's Wordfence team say in a report on Tuesday. While ThemeFusion, the developer behind Avada and Fusion Builder, fixed the vulnerability, Wordfence is not sharing complete technical details to give administrators sufficient time to install the latest updates and has only provided the following attack chain overview: Exposing attacker-controlled input through a public request Passing that input to functionality restricted from anonymous users Invoking a privileged component outside its intended context Using request data to influence trusted state Accessing an insufficiently protected administrative operation Bypassing file-handling restrictions on what could be written and where Despite the critical severity of the flaw, the researchers clarify that exploitation requires a vulnerable version of both the Avada theme and the Fusion Builder plugin to be active on the target website. Although the Avada theme is popular, with more than 1 million sales, the prerequisites for exploiting CVE-2026-18431 significantly narrow the pool of potential targets. Wordfence discovered the six-step vulnerability chain using an internal agentic framework called Argus, which also developed proof-of-concept exploit code, all in about two hours. Argus found and successfully reproduced the flaw on July 30, and the researchers shared the full details to the vendor on August 5. ThemeFusion acknowledged the report on August 10 and released fixes in Avada 7.16.1 and Fusion Builder 3.16.1 yesterday. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical Elementor Pro bug exposes WordPress sites to RCE attacksOne threat actor responsible for 83% of recent Ivanti RCE attacksHackers target WordPress sites in miniOrange auth bypass attacksCISA orders urgent patching of actively exploited Zimbra flawMicrosoft patches max severity code execution, privilege escalation flaws

Indicators of Compromise

• cve — CVE-2026-18431

Entities