Researchers from Defiant’s Wordfence team warned of a series of critical vulnerabilities in the popular Avada theme for the WordPress platform, allowing an unauthenticated attacker to execute arbitrary PHP instructions on the server through an attack that requires no user click. The six vulnerabilities are collectively tracked under CVE-2026-18431 and received a severity score of 9.8 out of 10.
ThemeFusion, the developer of the Avada theme and Fusion Builder plugin, released fixes in Avada 7.16.1 and Fusion Builder 3.16.1 on August 25, 2026. The flaw affects Avada versions up to 7.16 and Fusion Builder versions up to 3.16. Site operators must update both components, as the plugin is required to run the theme and is installed with it, according to an explanation Wordfence gave to BleepingComputer.
A Six-Step Chain Instead of a Single Vulnerability
The exploit does not rely on one independent issue; instead, it links six types of weaknesses in a specific sequence. The chain begins by exposing attacker-controlled inputs through a public request, then passing those inputs to a function unavailable to anonymous users, and invoking a component with privileges outside its intended context.
Next, the request data is used to influence a trusted state, followed by access to an administrative operation that is insufficiently protected, and finally bypassing restrictions imposed on the file-handling mechanism to determine what can be written and where. This sequence is what transforms the disparate weaknesses into the ability to execute PHP code remotely.
What Changes in Practice for Site Owners?
If the attack succeeds, the attacker may be able to gain full control of the site and its associated server within the scope of the available privileges. Potential consequences include planting malware, accessing databases, redirecting visitors to malicious sites, or creating unauthorized administrator accounts.
The importance of the flaw is amplified by Avada’s broad user base, with sales exceeding one million copies. According to Wordfence, the presence of the theme effectively means that Fusion Builder, which is required to run it, is also present. Therefore, the technical requirements do not narrow the pool of targeted sites as initially believed: every site using Avada is at risk if it remains on an affected version.
Why Does This News Matter?
The danger lies in the combination of three factors: a critical security rating, no requirement for authentication or victim interaction, and the component’s widespread use across WordPress sites. The nature of the chain also makes updating both the theme and the plugin a priority, rather than checking only one of them.
Wordfence discovered the flaw on July 30, 2026, using an internal agentic-AI-guided framework called Argus, and the framework successfully reproduced it and developed proof-of-concept code in approximately two hours. The researchers shared the full details with ThemeFusion on August 5, and the company acknowledged the report on August 10. Wordfence did not publish the complete technical details to give site administrators time to install the updates, so the source does not clarify whether active attacks occurred before the fixes became available.