Arbitrary File Upload Vulnerability in Avada Theme by ThemeFusion
CVE-2026-115346

8.1HIGH

Key Information:

Vendor

WordPress
Status
Avada | Website Builder For WordPress & WooCommerce
Vendor
CVE Published:
30 October 2026

What is CVE-2026-115346?

The Avada theme for WordPress is affected by a vulnerability that allows unauthenticated attackers to upload unauthorized files through the convert_palette_images_to_truecolor() function. This occurs due to inadequate file type validation, potentially enabling attackers to execute arbitrary code on the server. It is essential for users of Avada versions up to and including 7.16.2 to apply security measures to mitigate this risk and protect their WordPress installations.

Affected Version(s)

Avada | Website Builder For WordPress & WooCommerce 0 <= 7.16.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/avada-responsive-multipurpos...
https://avada.com/blog/version-7-16-4-security-update/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhamad Visat
.