Loading story…
A critical unauthenticated remote-code-execution vulnerability, CVE-2026-18431 (CVSS 9.8), affects the Avada WordPress theme through version 7.16 when its bundled Fusion Builder plugin through version 3.16 is installed and active. The six-stage exploit chain combines authorization, trust-boundary, input-validation, and file-handling flaws, enabling remote attackers to write and execute arbitrary PHP files and potentially take full control of vulnerable WordPress sites; exploitation also requires certain administrator-authored content.
ThemeFusion released fixes in Avada 7.16.1 and Fusion Builder 3.16.1. Wordfence reported that its Argus agent discovered and reproduced the chain and produced a proof of concept, which Wordfence validated in an isolated environment; firewall protection was made available to paid customers before the public disclosure and was scheduled for free users. No public exploit or CISA Known Exploited Vulnerabilities listing had been reported at publication.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
ThemeFusion publicly released Avada 7.16.1 and Fusion Builder 3.16.1, which fully address the six weaknesses comprising CVE-2026-18431.
ThemeFusion provided pre-release patched packages for Avada and Fusion Builder to Wordfence for review.
ThemeFusion acknowledged Wordfence's report concerning CVE-2026-18431.
Wordfence submitted full technical details of the Avada and Fusion Builder vulnerability chain to ThemeFusion through its Vulnerability Management Portal.
Wordfence provided Premium, Care, and Response customers a firewall rule covering known exploitation techniques for CVE-2026-18431.
Wordfence Argus discovered and reproduced CVE-2026-18431, a six-step unauthenticated file-write chain in Avada and Fusion Builder that can enable arbitrary PHP execution. Wordfence validated the proof of concept in an isolated environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesocradar.io
Open sourcebleepingcomputer.com
Open sourcethreataft.com
Open sourcemalware.news
Open sourceavada.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the **Avada (Fusion) Builder** WordPress plugin, tracked as `CVE-2026-8713`, allows unauthenticated attackers to delete arbitrary files on affected sites and potentially seize control of them. The flaw, rated **CVSS 9.1**, affects all versions through **3.15.3** and is caused by insufficient file path validation in the plugin’s `maybe_delete_files()` function, enabling path traversal through the `wp_ajax_nopriv_fusion_form_submit_ajax` handler. The issue is especially dangerous on sites with a published Avada form configured to save entries to the database, where a crafted submission can trigger immediate privacy cleanup and remove sensitive files such as `wp-config.php`. Security researchers said deleting key WordPress files can force a site back into setup mode, creating a path to **full site compromise** and possible **remote code execution**. The bug was reported by researcher **daroo** through the Wordfence Bug Bounty Program, and ThemeFusion patched it in **Avada Builder 3.15.4**. The vulnerability impacts a plugin ecosystem used by roughly **one million WordPress sites**; while there is no confirmed evidence of widespread exploitation, defenders have been urged to update immediately, and Wordfence said its firewall can block exploit attempts by detecting path traversal sequences in submitted form data.
Jun 29, 2026
A critical unauthenticated arbitrary file deletion vulnerability, tracked as **CVE-2026-8713**, was disclosed in the **Avada (Fusion) Builder** plugin for WordPress. The flaw affects versions through **3.15.3** and stems from insufficient validation of the `file_path` parameter in the `maybe_delete_files()` function within the `Fusion_Form_DB_Entries` class, enabling directory traversal and deletion of arbitrary files on the server. Researchers warned that attackers could delete sensitive files such as `wp-config.php`, potentially forcing a WordPress site into a reinstallation state and allowing an adversary to seize **administrative control** and possibly achieve **remote code execution**. Wordfence reported that a patch has been released, and the security community has already published a **Nuclei** detection template to help defenders identify exposed installations and prioritize remediation.
Jul 22, 2026
Two vulnerabilities in the widely used **Avada Builder** WordPress plugin exposed more than 1 million sites to data theft risks, including an unauthenticated SQL injection flaw tracked as `CVE-2026-4798` and an authenticated arbitrary file read flaw tracked as `CVE-2026-4782`. Security researchers said the SQL injection issue could allow attackers to extract sensitive database contents, including credentials and password hashes, while the file read bug could let low-privileged users access sensitive files such as `wp-config.php`. The flaws were discovered by researcher **Rafie Muhammad** through the Wordfence Bug Bounty Program, and the vendor addressed the issues in **Avada Builder 3.15.3**. Reports said the vulnerabilities affected versions up to `3.15.2` and `3.15.1` respectively, with the SQL injection issue requiring a specific WooCommerce-related condition for exploitation. Administrators were urged to update immediately, review subscriber and other low-privilege accounts, and monitor for suspicious file access and unusual database activity on unpatched sites.
Jun 29, 2026