Terms

CVE-2026-18431

Follow the latest coverage, related explainers and connected technology stories.

Latest coverage

CN
Critical Avada Vulnerability Enables Remote PHP Command Execution Without User Interaction

Critical Avada Vulnerability Enables Remote PHP Command Execution Without User Interaction

The CVE-2026-18431 vulnerability combines six security issues in the Avada theme and Fusion Builder plugin, allowing an unauthenticated attacker to execute PHP instructions and take control of the site. ThemeFusion released fixes in Avada 7.16.1 and Fusion Builder 3.16.1 after the installation base was estimated at more than one million sales.