ThemeFusion patched a critical remote code execution vulnerability in Avada, the WordPress theme that has sold more than a million licenses on ThemeForest, on August 26. Tracked as CVE-2026-18431, the flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker write PHP files to the server by chaining weaknesses across Avada (versions up to 7.16) and its required companion plugin, Fusion Builder (versions up to 3.16). Fusion Builder ships with every Avada install, so any site running an unpatched copy of the theme carried the exposure. If you use Avada, update to version 7.16.1 and Fusion Builder to 3.16.1 now, both together.
How the Avada File-Write Bug Works
According to Wordfence’s advisory, researcher Alex Thomas found the bug through the company’s internal Argus framework on July 30 and reported it to ThemeFusion on August 5. The vendor acknowledged the report on August 10 and shipped a fix sixteen days later. The chain routes public input into a function meant to stay restricted to logged-in administrators, invokes that function outside the context those restrictions assume, and then slips past the file-handling checks that are supposed to stop arbitrary files from landing on disk. Once a file lands, an attacker can execute it directly, which opens the door to malware installation, database access, or a rogue admin account.
One caveat worth being precise about: NVD’s own description notes that exploitation requires “certain administrator-authored content to be present” alongside both components being active. That’s a real precondition, not a footnote to skip past, and it means the bug isn’t quite the guaranteed hit some early coverage implied. It’s still trivial enough to reach, and the install base large enough, that treating this as urgent is the right call regardless.
What to Do If You Run Avada
- Update both Avada and Fusion Builder together. Patching one without the other leaves the chain intact.
- Check the WordPress admin user list for accounts you don’t recognize, especially any created in the past month.
- Look through your uploads directory and theme folders for PHP files that shouldn’t be there.
- If you can’t update right away, a web application firewall rule from your host or security plugin is a stopgap, not a substitute for the patch.
This is at least the fourth critical WordPress plugin or theme disclosure in the past two weeks, following bugs in TranslatePress, WPMU DEV Dashboard, and GiveWP. None of these share a root cause. What they share is that most of the affected sites were running themes and plugins nobody had checked in months. A scheduled WordPress maintenance and audit pass, or custom-built functionality through plugin development that doesn’t carry a page builder’s entire attack surface, is usually the difference between hearing about a bug like this from a post like this one and hearing about it from an intrusion alert.
