VulnerabilityBleeping Computer
9.8 — CRITICAL
Critical Avada WordPress theme flaw enables zero-click RCE
A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical vulnerability chain in the Avada WordPress theme enables zero-click RCE, allowing an unauthenticated attacker to execute arbitrary PHP code on a server. The flaw affects versions up to 7.16 and Fusion Builder plugin versions up to 3.16.
⚙️Technical Details
CVEs
CVE-2026-18431
Affected Systems
Avada theme for WordPressFusion Builder plugin
Attack Vectors
NETWORK
💥Impact Assessment
Severity: critical
Who Is at Risk
Website administrators with vulnerable versions of Avada and Fusion Builder installed
🛡️Recommended Actions
1Immediately update to the latest version of Avada (7.16.1) and Fusion Builder (3.16.1)
2Disable public requests for input fields that are not intended for anonymous users
3Regularly monitor website logs for suspicious activity
📦Affected Products
Avada theme for WordPressFusion Builder plugin
🔐NVD Verified DataVERIFIED
CVE-2026-18431 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-862
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.