Security researchers have disclosed a critical vulnerability chain in the widely used Avada WordPress theme that allows unauthenticated attackers to execute arbitrary PHP code on affected servers without any user interaction.

The flaw, tracked as CVE-2026-18431, carries a critical severity score of 9.8 and affects Avada theme versions up to 7.16 along with its companion Fusion Builder plugin versions up to 3.16. Wordfence, the security team at Defiant, published details of the chain on Tuesday after coordinating a fix with ThemeFusion, the developer behind both products.

A Six-Step Exploit Chain

Rather than a single bug, CVE-2026-18431 strings together six distinct weaknesses spanning authorization, input validation, trust-boundary, and file-handling issues. Wordfence has withheld full technical detail to give site owners time to patch, but outlined the general attack flow:

  • Exposing attacker-controlled input through a public request
  • Passing that input to functionality restricted from anonymous users
  • Invoking a privileged component outside its intended context
  • Using request data to influence trusted state
  • Accessing an insufficiently protected administrative operation
  • Bypassing file-handling restrictions on what could be written and where

Successful exploitation could let an attacker fully compromise a website, planting malware, accessing the underlying database, redirecting visitors to malicious domains, or creating rogue administrator accounts.

Narrower Attack Surface, Still a Serious Risk

Despite the critical rating, Wordfence notes that exploitation requires vulnerable versions of both the Avada theme and the Fusion Builder plugin to be active simultaneously on a target site. Avada has reportedly sold more than one million licenses, but the dual-component requirement narrows the realistic pool of exploitable targets.

The chain was discovered using Wordfence’s internal agentic framework, Argus, which identified and reproduced the vulnerability, and generated proof-of-concept exploit code, in roughly two hours on July 30. Wordfence disclosed full details to ThemeFusion on August 5, the vendor acknowledged the report on August 10, and patched fixes shipped in Avada 7.16.1 and Fusion Builder 3.16.1.

Recommended Action

Administrators running Avada should immediately update to version 7.16.1 and Fusion Builder to 3.16.1 or later. Given the critical severity and the theme’s broad install base, sites still running vulnerable pairings of the theme and plugin should be treated as high priority for patching.