CVE-2026-18431
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The Avada theme for WordPress up to version 7.16 is vulnerable to Arbitrary File Write when the Fusion Builder plugin is installed and active in versions up to 3.16. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write attacker-controlled files to the server, leading to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder installed and active, as well as certain administrator-authored content.
Risk Assessment
The organization risks complete compromise of the WordPress site, including arbitrary code execution and data theft.
Recommendation
Update the Avada theme and Fusion Builder plugin to the latest versions. Remove unused administrator content and monitor file integrity.
Original NVD description (English source)
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.