Avada

Wordfence published CVE-2026-18431 on August 25, 2026 for Avada, the commercial WordPress theme, when used with its bundled Fusion Builder plugin. The impact is critical: an unauthenticated attacker can chain multiple weaknesses into arbitrary PHP file creation and execution on the server.

Wordfence says the vulnerable chain requires both Avada and Fusion Builder to be installed and active, plus certain administrator-authored content to be present. Avada has more than one million sales, so even a conditional exploit path has a large practical blast radius.

Vulnerability Summary

• CVE: CVE-2026-18431
• Severity: CVSS 9.8 critical
• Theme affected: Avada up to and including 7.16
• Plugin affected: Fusion Builder up to and including 3.16
• Fixed versions: Avada 7.16.1 and Fusion Builder 3.16.1
• Privileges required: none
• User interaction: none
• Impact: arbitrary file write leading to remote PHP code execution and full site compromise

Exploit Path

Wordfence intentionally withheld the full exploit details, but described the issue as a six-step chain across the theme and builder. The high-level failure pattern is that attacker-controlled public input can reach internal behavior, invoke privileged builder functionality outside its expected context, influence trusted request state, and reach an administrative maintenance operation with insufficient authorization and file-write constraints.

No single weakness is enough by itself; the RCE happens when the chain is complete. That also means administrators can reduce risk by breaking any link in the chain, but the only complete remediation is applying the vendor patches for both Avada and Fusion Builder.

Immediate Remediation

• Update Avada to 7.16.1 or newer.
• Update Fusion Builder to 3.16.1 or newer at the same time.
• Use the Avada/ThemeFusion update flow or manually upload the fixed commercial packages if automatic updates are not available.
• Review the server for unexpected PHP files in writable theme, plugin, uploads, cache, and temporary directories.
• Rotate administrator credentials and invalidate sessions if file-write activity or unknown admin access is found.

WP-CLI Verification

Commercial theme update mechanisms vary by license state, so use WP-CLI first for version confirmation, then update through Avada Dashboard or the vendor package workflow.

wp theme get Avada --fields=name,version,status
wp plugin get fusion-builder --fields=name,version,status
wp option get stylesheet

Run a defensive file review for recently modified PHP files. Inspect findings manually before deleting anything.

find wp-content -type f -name '*.php' -mtime -7 -print
wp core verify-checksums
wp plugin verify-checksums --all

Temporary Mitigation

The correct fix is Avada 7.16.1 plus Fusion Builder 3.16.1. If you cannot patch immediately, disable Fusion Builder or restrict public traffic to affected dynamic builder routes through a WAF while preparing the update. This may break Avada-built pages, so test impact before applying it to production.

# Emergency containment only. Update both components as the permanent fix.
wp plugin deactivate fusion-builder

Sources

• Wordfence Avada RCE advisory
• CVE-2026-18431 record
• Avada official site