Avada Theme for WordPress Vulnerable to Arbitrary File Write
CVE-2026-18431
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 August 2026
Badges
What is CVE-2026-18431?
The Avada theme for WordPress presents a significant security risk due to an arbitrary file write vulnerability that affects all versions up to 7.16 when paired with an active Fusion Builder plugin (up to version 3.16). This flaw stems from a combination of authorization issues and inadequate input validation, allowing unauthenticated attackers to write malicious files to the server. By exploiting this vulnerability, attackers can create and execute arbitrary PHP files, potentially leading to remote code execution and full compromise of the affected WordPress site. For successful exploitation, both the Avada theme and Fusion Builder must be installed and functional alongside specific content authored by an administrator.
Affected Version(s)
Avada (Fusion) Builder 0 <= 3.16
Avada | Website Builder For WordPress & WooCommerce 0 <= 7.16
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Critical Avada WordPress theme flaw enables zero-click RCE
A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server.
3 weeks ago
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved