Loading vulnerability…
Unauthenticated Arbitrary File Write and RCE in Avada and Fusion Builder
CVE-2026-18431 is a critical six-stage vulnerability chain affecting the Avada WordPress theme through version 7.16 when Fusion Builder, also branded Avada Builder, through version 3.16 is installed and active. Missing authorization and input-validation weaknesses, together with trust-boundary and file-handling restriction bypasses across the two components, allow unauthenticated remote attackers to write attacker-controlled files. Attackers can write and execute arbitrary PHP files, resulting in remote code execution in the web-server process context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthenticated remote code execution and can result in complete compromise of the affected WordPress site. An attacker may deploy web shells or other persistent backdoors, steal WordPress data and secrets accessible to the web-server process, alter site content, create rogue administrator accounts, redirect visitors, and use the server as a foothold for further activity.
If you can’t patch tonight, do this now.
Where prompt patching is not possible, disable or remove Fusion Builder if it is not necessary for site functionality, or disable the affected Avada deployment where operationally feasible. Restrict public access to exposed WordPress instances where feasible. Review writable WordPress, theme, and plugin locations for unexpected PHP files; investigate unauthorized administrative, plugin, scheduled-task, configuration, process, or outbound-network changes. A web-application firewall rule designed to block known exploitation techniques may provide interim protection but is not a substitute for updating.
Patch, then assume compromise.
Update both components: upgrade Avada to version 7.16.1 or later and Fusion Builder/Avada Builder to version 3.16.1 or later. Verify the installed and active versions of both the theme and its companion plugin across production and staging environments; updating only one component is insufficient.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.