Critical Vulnerabilities Discovered in Avada WordPress Theme
A significant vulnerability chain has been uncovered within the widely utilized Avada theme for WordPress, which allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
This exploit consolidates six security flaws into a zero-click attack vector. Collectively designated as CVE-2026-18431, these vulnerabilities have been assigned a critical severity rating of 9.8.
The attack exploits deficiencies in authorization, input validation, trust boundaries, and file handling. These vulnerabilities must be exploited sequentially to facilitate the execution of arbitrary PHP code on the target server.
Successfully leveraging these flaws empowers hackers to fully compromise websites, enabling a range of malicious activities such as the deployment of malware, database breaches, redirection of visitors to harmful sites, or the creation of unauthorized admin accounts.
CVE-2026-18431 impacts Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16, as reported by researchers from Defiant’s Wordfence team on Tuesday.
While ThemeFusion, the company behind the Avada theme and Fusion Builder, has implemented fixes for these vulnerabilities, Wordfence has opted not to disclose comprehensive technical details to allow administrators ample opportunity to install the latest updates. They have provided a brief overview of the exploit chain:
- Exposing attacker-controlled input via a public request
- Passing this input to functions restricted from anonymous users
- Invoking a privileged component outside its intended context
- Leveraging request data to influence trusted state
- Accessing inadequately protected administrative operations
- Bypassing restrictions on file handling related to write permissions
While the exploitation necessitates that both the Avada theme and the Fusion Builder plugin remain active on the target website, Wordfence researchers emphasized to BleepingComputer that “Fusion Builder is a required plugin for the Avada theme.”
“Thus, all sites utilizing the Avada theme will invariably operate with the Fusion Builder plugin,” the researchers noted.
The Avada theme enjoys immense popularity, having achieved over one million sales. Because Fusion Builder is bundled with it, “the prerequisites do not limit the pool of potential targets,” explained Wordfence.
“Any site implementing the Avada theme is vulnerable to exploitation.”
Wordfence identified the six-step vulnerability chain utilizing an internal framework known as Argus, which also crafted proof-of-concept exploit code in approximately two hours.
Argus successfully identified and replicated the vulnerabilities on July 30, with full disclosure provided to the vendor on August 5.
ThemeFusion acknowledged this report on August 10 and subsequently released patches in Avada 7.16.1 and Fusion Builder 3.16.1.
Source link: Bleepingcomputer.com.
