Zero-click RCE in Avada leaves million sites exposed

Popular WordPress themes rarely come with a welcome mat for attackers, but a newly disclosed vulnerability chain in the Avada theme hands unauthenticated intruders a zero-click path to arbitrary code execution. With more than a million sales, the flaw could put a substantial slice of the WordPress ecosystem at risk.

Six-step chain, one critical score

The bug is tracked as CVE-2026-18431 and carries a 9.8 critical severity score. It's not a single defect but a chain of six distinct security weaknesses that must be triggered in a precise order, according to researchers at Defiant's Wordfence team.

Exploitation involves issues in authorization, input-validation, trust-boundary, and file-handling logic. Pulled together, they allow an unauthenticated attacker to execute arbitrary PHP code on the target server.

What a full compromise enables

Successful exploitation gives attackers the keys to a site. Wordfence notes that compromised sites could be used for planting malware, accessing databases, redirecting visitors to malicious pages, or adding rogue administrator accounts.

The attack requires no user interaction, which makes the practical risk higher than a typical flaw that depends on a victim clicking something.

Affected versions and scope

CVE-2026-18431 affects Avada versions up to 7.16 and the Fusion Builder plugin versions up to 3.16. Fusion Builder is a required companion to Avada, so every Avada site also runs the plugin.

Wordfence told BleepingComputer: "Fusion Builder is a required plugin for the Avada theme. Therefore all sites running the Avada theme will also be running the Fusion Builder plugin."

"[That being said...] the prerequisites don't narrow the pool of potential targets. Any site that has the Avada theme installed is going to be exploitable."

Attack chain overview

Wordfence has not released full technical specifics, to give administrators time to patch. The team provided a high-level overview of the six steps:

• Exposing attacker-controlled input through a public request
• Passing that input to functionality restricted from anonymous users
• Invoking a privileged component outside its intended context
• Using request data to influence trusted state
• Accessing an insufficiently protected administrative operation
• Bypassing file-handling restrictions on what could be written and where

Discovery by an automated agent

Wordfence discovered the chain using an internal agentic framework called Argus. The tool also produced proof-of-concept exploit code, and the entire process took about two hours.

The discovery was successfully reproduced on July 30, with full details shared with the vendor on August 5. ThemeFusion acknowledged the report on August 10 and released fixes in Avada 7.16.1 and Fusion Builder 3.16.1.

Patch status and what to do

ThemeFusion has addressed the vulnerability in the latest releases. Wordfence's report emphasizes the need for administrators to update both the theme and the plugin to patched versions to close the hole.

Organizations running Avada should verify that both components are updated, since the chain depends on both being vulnerable.

While full details are withheld for now, the disclosure pressure is on: with a 9.8 severity and zero-click exploitation, the window to patch before attackers reverse-engineer the fix is likely to be short.

Why it matters

For the large number of sites relying on Avada, this chain highlights how a single theme can become an entry point for total takeover. The fact that an automated tool found the flaw in a couple of hours suggests that attackers with similar capabilities could be hunting for comparable chains in other popular plugins.

Site administrators should treat this as a firm reminder to audit not just core WordPress and plugins, but the themes that tie everything together, and to update promptly when fixes land. Waiting could leave a zero-click path open for attackers who move fast after details go public.