Avada Theme for WordPress Vulnerable to Arbitrary File Write

CVE-2026-18431

What is CVE-2026-18431?

The Avada theme for WordPress presents a significant security risk due to an arbitrary file write vulnerability that affects all versions up to 7.16 when paired with an active Fusion Builder plugin (up to version 3.16). This flaw stems from a combination of authorization issues and inadequate input validation, allowing unauthenticated attackers to write malicious files to the server. By exploiting this vulnerability, attackers can create and execute arbitrary PHP files, potentially leading to remote code execution and full compromise of the affected WordPress site. For successful exploitation, both the Avada theme and Fusion Builder must be installed and functional alongside specific content authored by an administrator.

References