Critical Avada WordPress Flaw (CVE-2026-18431) Enables RCE

A critical vulnerability chain tracked as CVE-2026-18431 affects the Avada WordPress theme and its required Fusion Builder plugin, now branded as Avada Builder. The flaw carries a CVSS score of 9.8 and can allow an unauthenticated attacker to write and execute arbitrary PHP files, potentially leading to complete site compromise.

ThemeFusion released fixes on August 25, 2026. Administrators should update Avada to 7.16.1 or later and Fusion Builder to 3.16.1 or later, then verify that both updated versions are active.

CVE-2026-18431 at a Glance

What Is CVE-2026-18431?

CVE-2026-18431 is an arbitrary file-write vulnerability caused by a chain of authorization and input-validation weaknesses across Avada and Fusion Builder. An unauthenticated attacker can use the chain to place an attacker-controlled PHP file on the server and then execute it remotely.

The important point is that this is not one isolated input flaw. The attack crosses several trust boundaries between the theme and builder. Publicly released information describes six stages involving attacker-controlled input, access to restricted functionality, manipulation of trusted state, and the bypass of file-handling restrictions.

Wordfence discovered and reproduced the chain with its Argus research system on July 30 and disclosed it to ThemeFusion on August 5. The vendor acknowledged the report on August 10 and released the patched versions on August 25.

Which Sites Are Affected?

A site may be exposed when it has Avada 7.16 or earlier and Fusion Builder 3.16 or earlier installed and active, along with the administrator-authored content required by the exploit chain. Wordfence notes that Fusion Builder is a required plugin for Avada, so the two-component prerequisite does not meaningfully reduce the pool of potentially affected Avada sites.

Successful exploitation also requires certain administrator-authored content to be present. However, Wordfence has not publicly described the exact content prerequisite, so administrators should not rely on this condition to rule out exposure or delay patching.

Why Is the Flaw So Serious?

Arbitrary file write becomes remote code execution when an attacker can create an executable PHP file in a web-accessible location. The code runs with the permissions of the web server process, which can give the attacker control over the WordPress site and access to data or secrets available to that process.

A successful attacker could potentially:

• Install a web shell or another persistent backdoor
• Steal WordPress data, database credentials, API keys, or authentication salts
• Create rogue administrator accounts or alter site content
• Redirect visitors to phishing or malware pages
• Use the compromised server as a foothold for further activity

Is CVE-2026-18431 Being Exploited?

As of August 27, 2026, no in-the-wild exploitation has been publicly confirmed, and CVE-2026-18431 is not listed in CISA’s Known Exploited Vulnerabilities catalog. Wordfence developed and validated a working end-to-end proof of concept against an isolated target, but withheld the details needed to reproduce the exploit.

That distinction matters: the vulnerability is demonstrably exploitable, but an internal research proof of concept is not the same as publicly released exploit code or observed criminal exploitation. Its unauthenticated attack path, severe impact, and large Avada footprint still justify urgent remediation.

What Should Defenders Do Now?

• Patch both components: Update Avada to 7.16.1 or later and Fusion Builder to 3.16.1 or later.
• Verify the running versions: Check every production, staging, development, and disaster-recovery site rather than relying only on update status.
• Reduce exposure if patching is delayed: Temporarily deactivate Fusion Builder where operationally feasible and deploy a security-provider WAF rule specifically designed for this vulnerability chain. Wordfence Premium, Care, and Response customers received such protection on July 30, while free users are scheduled to receive it on August 29.
• Hunt for compromise: Review web and file-system activity for unexpected PHP files, access to newly created scripts, suspicious administrator accounts, and abnormal outbound connections from the web server.
• Respond beyond the plugin: If compromise is suspected, isolate the site, preserve evidence, remove persistence, and rotate database credentials, API keys, WordPress salts, and other secrets accessible from the host.

What Should Security Teams Monitor?

Complete exploit-specific indicators have not been released, so monitoring should focus on behavior rather than a narrow list of request parameters. Useful signals include:

• New or modified PHP files in writable WordPress directories
• Direct requests to unfamiliar PHP files shortly after file creation
• Unexpected child processes or outbound network connections from PHP or the web server
• New administrator accounts, altered plugins, scheduled tasks, or configuration changes
• Repeated unauthenticated requests to Avada or Fusion Builder functionality followed by file-system changes

Why This Is More Than a Routine Theme Update

The flaw shows how vulnerabilities can emerge at the boundary between tightly integrated components. Each stage of the chain changes the application’s state or trust context until a public request reaches a file-writing operation that should never be available to an anonymous user.

For WordPress fleets, theme and companion-plugin versions must be inventoried together. Updating only the visible theme, overlooking staging sites, or assuming a managed host applied both fixes can leave the exposure unresolved.

How SOCRadar Can Help Prioritize the Risk

SOCRadar Vulnerability Intelligence helps teams track newly disclosed CVEs, exploitation signals, and remediation information, while Attack Surface Management can help identify internet-facing assets and exposed technologies across the organization’s external footprint. Together, these capabilities help teams move from disclosure awareness to asset-based prioritization.

Conclusion

CVE-2026-18431 provides an unauthenticated path to arbitrary PHP code execution on vulnerable Avada sites. Update both Avada and Fusion Builder, verify the running versions, and review exposed sites for unauthorized file creation or follow-on activity.