Six Chained Vulnerabilities in WordPress Avada Theme Allow Full Site Takeover

ThemeFusion's Avada theme, one of the most widely used WordPress themes with over a million sales, has been patched for a chain of six vulnerabilities that an unauthenticated attacker can exploit to execute arbitrary PHP code on the server with no admin interaction. The flaw, tracked as CVE-2026-18431 and rated 9.8 on the CVSS scale, was disclosed on August 26, 2026.

What Happened and When

The Wordfence threat intelligence team at Defiant discovered the vulnerability chain and shared full details with ThemeFusion on August 5. The vendor acknowledged the report on August 10. Fixes were released on August 25, one day before the public disclosure. ThemeFusion updated the Avada theme to version 7.16.1 and the Fusion Builder plugin to version 3.16.1.

The discovery dates back to July 30, when Argus, Defiant's internal agentic framework, identified and successfully reproduced the flaw. The proof of concept was developed in about two hours.

Vulnerable Components and Exact Versions

The vulnerability affects two products from the same vendor, both of which must be active and vulnerable for the attack to succeed:

• Avada theme – versions up to and including 7.16.
• Fusion Builder plugin – versions up to and including 3.16.

The fixed versions are 7.16.1 for the theme and 3.16.1 for the plugin. Users running Avada without Fusion Builder, or patched versions of either component, are not exposed to this specific chain.

How the Attack Chain Works

The zero-click attack combines six distinct security issues, which Wordfence described in a summary without full technical details to give administrators time to update. The reported sequence is as follows:

1. A public endpoint exposes user-controlled input.
2. The input is forwarded to functionality that should be restricted to anonymous users.
3. A privileged component is invoked outside its intended context.
4. Request data alters a state that is considered trusted.
5. An administrative operation lacking adequate protections becomes accessible.
6. Restrictions on file writing (content and location) are bypassed.

The final step allows writing PHP files to the server, leading to arbitrary code execution. Wordfence noted that the chain requires the combination of vulnerable versions of both components, which limits the number of potential targets. No evidence of in-the-wild exploitation was available at the time of publication.

Impact: Full Compromise and CVSS Vector

The CVSS score of 9.8, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, places the flaw in the critical range. A remote attacker can achieve arbitrary PHP code execution without privileges and without user interaction. The practical consequences include:

• installation of malware or backdoors;
• unauthorized access to the site database;
• redirecting visitors to malicious sites;
• creation of unauthorized administrator accounts.

In short, exploiting this flaw can take full control of the WordPress site and the data it manages.

Risk Surface: One Million Installations, but Restrictive Prerequisites

The Avada theme is one of the best-selling in WordPress history, with over a million copies. However, the requirement to also have Fusion Builder active significantly reduces the number of sites actually exposed to the chain. The plugin is not automatically installed with the theme in all configurations, and many users may have deactivated or replaced it.

It is not known whether CVE-2026-18431 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of publication. There is no available information about recent prior entries for the same vendor in that catalog.

What to Do Now

Administrators of WordPress sites running the Avada theme should immediately check installed versions. If the theme is version 7.16 or earlier and Fusion Builder is version 3.16 or earlier, and both are active, updates are required:

• Avada theme → version 7.16.1 or later.
• Fusion Builder plugin → version 3.16.1 or later.

Updates are already available through official ThemeFusion channels. No official workarounds have been provided; updating is the only indicated mitigation. Wordfence delayed full technical disclosure specifically to allow patches to be applied.

Discovery with Argus: An Automated Approach to Vulnerability Research

The vulnerability was identified by Argus, an agentic framework developed internally by Defiant, the company behind Wordfence. Argus analyzed the theme and plugin, identified the chain of six flaws, and produced a working proof of concept in about two hours from the initial discovery on July 30. ThemeFusion received full details on August 5 and acknowledged receipt on August 10, releasing fixes on August 25.

The episode shows how automation in vulnerability research can shorten the time between discovery and remediation, while also showing how a single update can close a complex chain of concurrent issues.