Critical Unauthenticated RCE in Avada Theme and Fusion Builder

A critical unauthenticated remote-code-execution vulnerability, CVE-2026-18431 (CVSS 9.8), affects the Avada WordPress theme through version 7.16 when its bundled Fusion Builder plugin through version 3.16 is installed and active. The six-stage exploit chain combines authorization, trust-boundary, input-validation, and file-handling flaws, enabling remote attackers to write and execute arbitrary PHP files and potentially take full control of vulnerable WordPress sites; exploitation also requires certain administrator-authored content.

ThemeFusion released fixes in Avada 7.16.1 and Fusion Builder 3.16.1. Wordfence reported that its Argus agent discovered and reproduced the chain and produced a proof of concept, which Wordfence validated in an isolated environment; firewall protection was made available to paid customers before the public disclosure and was scheduled for free users. No public exploit or CISA Known Exploited Vulnerabilities listing had been reported at publication.