CVE-2026-18431: themefusion avada | website builder for wordpress & woocommerce Missing Authorization

Vulnerability summary

CVE-2026-18431 is a critical (CVSS 9.8) Missing Authorization vulnerability in themefusion avada | website builder for wordpress & woocommerce. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities. Fixed in 7.16.1.

Timeline

1. 26-08-2026
   PublishedVulnerability first disclosed.
2. 27-08-2026
   Last modifiedVulnerability information updated.

Description

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.