CVE-2026-18431

CVE-2026-18431 is a critical (CVSS 9.8) arbitrary file write vulnerability in the Avada WordPress theme (all versions through 7.16) that is exploitable when the bundled Fusion Builder plugin (all versions through 3.16) is also installed and active. A chain of missing authorization (CWE-862) and input validation weaknesses across the two components allows unauthenticated attackers to write attacker-controlled files to the server. Because the attacker can create and execute arbitrary PHP files, successful exploitation leads to remote code execution and complete site compromise. Exploitation requires both components to be active and certain administrator-authored content to be present, narrowing the practical attack surface. No public proof of concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.6% chance of exploitation within 30 days.

What to do: Update Avada to a version later than 7.16 and the bundled Fusion Builder plugin to a version later than 3.16, ensuring both components are patched together. Since the flaw is exploitable without authentication, sites that cannot patch immediately should apply a WAF/virtual patch and audit writable directories and uploads folders for unexpected PHP files. After patching, review the administrator-authored content referenced by the vulnerable code paths and check logs for unauthenticated requests writing files to the server.