A critical vulnerability chain in the popular Avada theme for WordPress has been discovered, allowing an unauthenticated attacker to execute arbitrary PHP code on a server with ease. This exploit, tracked as CVE-2026-18431, received a 9.8 critical severity score and can be chained together from six separate security issues. The attack requires no interaction or tricking of the user into taking any action, making it particularly concerning.
The vulnerability affects Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16, which are widely used in WordPress websites. According to Defiant’s Wordfence team, hackers who successfully exploit these vulnerabilities could compromise websites for malicious activities such as planting malware, accessing databases, redirecting visitors to malicious sites, or adding rogue admin accounts.
The attack chain is complex and requires a specific sequence of events to occur. It involves exposing attacker-controlled input through a public request, passing that input to functionality restricted from anonymous users, invoking a privileged component outside its intended context, using request data to influence trusted state, accessing an insufficiently protected administrative operation, and finally bypassing file-handling restrictions on what could be written and where.
While the prerequisites for exploiting CVE-2026-18431 narrow the pool of potential targets, the severity of this flaw is critical. The Avada theme has over 1 million sales, making it a popular choice among WordPress users. However, despite its popularity, only websites running vulnerable versions of both the Avada theme and Fusion Builder plugin are at risk.
Wordfence discovered the six-step vulnerability chain using their internal agentic framework called Argus, which also developed proof-of-concept exploit code in just two hours. The researchers shared the full details with the vendor on August 5, who acknowledged the report on August 10 and released fixes in Avada 7.16.1 and Fusion Builder 3.16.1 yesterday.
Website administrators are advised to update their Avada theme and Fusion Builder plugin to the latest versions as soon as possible to prevent exploitation of this critical vulnerability. The attack requires a vulnerable version of both components, making it essential for users to stay up-to-date with the latest security patches.
Source: Bleeping Computer — 2026-08-26