Critical Exploit Chain in Avada Theme and Fusion Builder Unlocks Unauthenticated RCE
A critical vulnerability tracked as CVE-2026-18431 with a 9.8 CVSS score enables unauthenticated remote code execution on WordPress instances running the Avada theme. The exploit ties together six distinct flaws spanning authorization, input validation, trust-boundary, and file-handling weaknesses into a zero-click attack path. Successful exploitation allows an attacker to execute arbitrary PHP code directly on the target host. This level of access enables complete site takeover, database exfiltration, malware deployment, malicious redirects, and the creation of rogue administrator accounts. The vulnerability impacts Avada versions up to 7.16 alongside Fusion Builder plugin versions up to 3.16. While both components are strictly required to trigger the full exploit chain, Fusion Builder is a mandatory plugin bundled with the Avada theme. Consequently, all sites using the Avada theme ship with the necessary dependencies and remain vulnerable. Defiant's Wordfence team discovered and reproduced the issue using an automated agentic framework named Argus, which also developed functional proof-of-concept exploit code. ThemeFusion resolved the flaws by issuing patches in Avada version 7.16.1 and Fusion Builder version 3.16.1. Full technical details are currently withheld by researchers to allow system administrators time to apply the updates.
Read more about Critical Exploit Chain in Avada Theme and Fusion Builder Unlocks Unauthenticated RCE