Full research report

Critical Avada WordPress theme flaw enables zero-click RCE

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-18431 is not a single isolated file-upload mistake but a conditional chain spanning public request handling, authorisation, trusted request state and file operations. Wordfence demonstrated that the full sequence can write and execute PHP as the web server, but each link is required and the CVE record adds a material prerequisite: certain administrator-authored content must be present. Patched versions are Avada 7.16.1 and Fusion Builder 3.16.1, both released on 25 August 2026. No public exploit code, threat actor attribution, malware association or confirmed in-the-wild exploitation was found, and the vulnerability was absent from the CISA Known Exploited Vulnerabilities catalogue at the time checked.

What happened

Wordfence discovered and reproduced CVE-2026-18431 on 30 July 2026, disclosed it to ThemeFusion on 5 August and received a pre-release fix on 12 August. ThemeFusion released Avada 7.16.1 and Fusion Builder 3.16.1 on 25 August, with the CVE record published on 26 August. The flaw chains six weaknesses to permit unauthenticated arbitrary PHP execution without victim interaction.

Affected scope

Avada theme versions up to and including 7.16 combined with an installed and active Fusion Builder plugin up to and including 3.16. Successful exploitation additionally requires certain administrator-authored content to be present, so installation of the affected components establishes exposure but does not by itself prove that every site satisfies the full chain. Avada has more than one million reported sales, indicating potentially broad exposure across organisations using WordPress.

Technical assessment

The demonstrated path carries attacker-controlled data from a public request through functionality not intended for anonymous users, crosses a privileged trust boundary, influences trusted request state and reaches an insufficiently authorised maintenance operation. Inadequate file-handling restrictions then permit an attacker-controlled PHP file to be written and executed in the web-server security context. All six links are required; a public proof of concept has not been released, and technical details remain intentionally limited.

Recommended defensive actions

  1. update Avada to 7.16.1 or later and Fusion Builder to 3.16.1 or later as a coordinated change
  2. inventory all WordPress installations for active or dormant copies of Avada and Fusion Builder, including externally managed sites
  3. verify deployed component versions after updating and remove obsolete package copies from the server
  4. inspect web roots and writable directories for unexpected PHP files, recent unauthorised modifications and unfamiliar administrator accounts
  5. review web and application logs for suspicious unauthenticated requests correlated with file creation or PHP execution
  6. deploy the applicable web application firewall protection as temporary defence in depth, without treating it as a substitute for patching

Uncertainties and evidence gaps

  • No verified evidence of exploitation in the wild or identified threat actor was found as of 27 August 2026.
  • The specific administrator-authored content required for successful exploitation has not been publicly described.
  • Wordfence created a working private proof of concept, but it is unknown whether other parties have independently developed exploit code.
  • The supplied media report stated that any Avada site would be exploitable, whereas the authoritative CVE record requires certain administrator-authored content; the CVE record is stronger evidence for the conditional scope.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to a WordPress site running both affected components; no victim click is required, but qualifying administrator-authored content must exist.
ComponentThe boundary between public Avada requests, privileged Avada/Fusion Builder behaviour and an administrative file-maintenance operation.
MechanismA six-stage chain of missing authorisation, insufficient input validation, trust-boundary failures and inadequate file-write restrictions allows public request data to reach a privileged file operation.
ImpactArbitrary PHP execution in the web-server context, enabling complete WordPress site compromise, data access, malicious modification and service disruption.
DetectionUnexpected PHP files or file modifications in the WordPress installation, particularly when correlated with unauthenticated web requests, followed by unfamiliar processes, accounts or site changes.
MitigationUpdate Avada to 7.16.1 or newer and Fusion Builder to 3.16.1 or newer; deploy available firewall protection only as supplementary defence.
Exploitation status

No confirmed active exploitation; Wordfence privately reproduced a working proof of concept, but no public exploit code was identified.

Research process

The investigation began by testing the supplied report against primary records for the CVE, affected software and release timeline. The CVE Program, Wordfence and Avada sources independently confirmed the vulnerability and patched release, while the Cybersecurity and Infrastructure Security Agency catalogue supplied no indication of known exploitation. The resulting assessment confirms a critical, remotely reachable chain with a private working proof of concept, but not current exploitation or publicly available exploit code.

  1. Could the supplied report be independently inspected and treated as evidence?
    Opened the supplied BleepingComputer article.
    bleepingcomputer.com ↗

    The page returned an automated security-verification screen, so its article text could not be independently validated through the live page.

    why The supplied article remained a lead rather than supporting evidence, making primary records necessary.

  2. Is CVE-2026-18431 a published record, and what scope does it define?
    Opened the CVE Program record and reviewed its description, severity, affected products and references.
    cve.org ↗

    The record was published on 26 August 2026 and identifies Avada through 7.16 and Fusion Builder through 3.16, with both components active and certain administrator-authored content required. It assigns CVSS 3.1 9.8 and describes unauthenticated arbitrary file write leading to PHP execution.

    why This confirmed the CVE and narrowed the scope beyond the broad claim that every Avada installation is necessarily exploitable.

  3. What exact fixed versions and remediation does the issuing authority specify?
    Opened the Wordfence vulnerability record referenced by the CVE entry.

    Wordfence identifies Avada 7.16.1 and Fusion Builder 3.16.1 as patched versions and confirms complete-site-compromise potential.

    why This provided actionable version thresholds from the CVE Numbering Authority responsible for the record.

  4. Did the vendor publish the reported patched Avada release?
    Reviewed the official Avada changelog.
    avada.com ↗

    The vendor page identifies Avada 7.16.1 as the latest version and records its release on 25 August 2026.

    why This independently corroborated the patch date and Avada release version on the vendor's own domain.

  5. Is the vulnerability recognised as exploited in the wild by a government authority?
    Searched the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalogue for the CVE identifier.
    cisa.gov ↗

    The catalogue search returned no entry for CVE-2026-18431.

    why Absence from the catalogue does not prove non-exploitation, but it provides no government confirmation supporting an active-exploitation claim.

  6. Was original technical research available beyond the concise vulnerability record?
    Searched Wordfence's published research for Avada and located the original disclosure.
    wordfence.com ↗

    The search returned the 25 August 2026 original research article as its newest Avada result.

    why This located the primary timeline and technical account rather than relying on secondary reporting.

  7. Was exploitation reproduced, was code released publicly and how does the chain work at a defensive level?
    Read the original Wordfence disclosure, including its chain summary and timeline.
    wordfence.com ↗

    Wordfence reports privately reproducing an end-to-end proof of concept on 30 July, disclosing on 5 August and coordinating fixes released on 25 August. It withholds detailed exploit information and describes six required weaknesses leading from an anonymous request to attacker-controlled PHP execution.

    why This establishes technical feasibility and private proof-of-concept availability, but it does not establish public exploit availability or exploitation in the wild.

Named in this story
TargetsInternet-accessible WordPress sites running Avada 7.16 or earlier with Fusion Builder 3.16 or earlier activeWordPress sites containing the administrator-authored content required by the demonstrated chain
Related CVEs CVE-2026-18431

Research coverage

All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (1 primary, 3 corroborating, 0 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 67 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok10 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
CISA KEVkev ok1682 records Corroborating1 matched items A page from this source was opened and verified during focused research.
NVDcve ok900 records Corroborating1 matched items A page from this source was opened and verified during focused research.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok12 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 11 opened outside the registered collection
References & evidence
PoC & exploit code1
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales wordfence.com ↗

Technical write-up confirms a privately validated end-to-end proof of concept while withholding exploit details.

Vendor & gov advisories1
Avada Changelog avada.com ↗

Vendor changelog identifies Avada 7.16.1 as the latest release, published on 25 August 2026.

Analysis & research2
CVE Record: CVE-2026-18431 cve.org ↗

Authoritative CVE record confirms the product scope, conditional exploitation requirements and CVSS 3.1 score of 9.8.

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales wordfence.com ↗

Original research provides the disclosure timeline, defender-safe chain description and patch information.