A critical vulnerability chain in the Avada theme for WordPress, tracked as CVE-2026-18431, could allow an unauthenticated attacker to achieve zero-click remote code execution (RCE) on affected websites. The exploit combines six distinct security issues, resulting in a critical severity score of 9.8.
The attack leverages a sequence of weaknesses, including authorization bypasses, input validation failures, trust boundary violations, and file-handling flaws. Successful exploitation could lead to full compromise of a website, enabling malicious activities such as malware installation, database access, redirection of visitors to malicious sites, or the creation of rogue administrative accounts.
The vulnerability affects Avada theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16. Researchers at Defiant's Wordfence team identified the flaw and reported it to ThemeFusion, the developers of Avada and Fusion Builder.
The attack chain involves several steps: exposing attacker-controlled input through a public request, passing that input to functionality typically restricted from anonymous users, invoking a privileged component outside its intended context, using request data to influence trusted state, accessing an insufficiently protected administrative operation, and bypassing file-handling restrictions on write operations.
ThemeFusion has released fixes for the vulnerability in Avada version 7.16.1 and Fusion Builder version 3.16.1. Wordfence has withheld full technical details of the exploit to allow administrators sufficient time to apply the necessary updates.
Despite the critical severity, exploitation requires both a vulnerable version of the Avada theme and the Fusion Builder plugin to be active on the target website. While Avada is widely used, with over 1 million reported sales, these prerequisites narrow the pool of potential targets.
The six-step vulnerability chain was discovered by Wordfence's internal agentic framework, Argus, which also developed proof-of-concept exploit code. Argus identified and reproduced the flaw on July 30. Wordfence shared full details with ThemeFusion on August 5, and the vendor acknowledged the report on August 10, releasing patches on August 25.
