CVE-2026-18431 is a critical remote code execution vulnerability affecting sites that run both the Avada theme and the Fusion Builder plugin together. It is a broken access control flaw (CWE-862): missing authorization checks let an unauthenticated attacker write attacker-controlled files to the server.

An attacker can use this arbitrary file write to create and execute PHP files of their choosing, resulting in full remote code execution on the web server.

The following version(s) are affected (both components must be present):

Avada theme 7.16 and earlier - (Affected)
Fusion Builder plugin 3.16 and earlier - (Affected)
Avada 7.16.1 and later, together with Fusion Builder 3.16.1 and later - (Not affected, patched)

Both the theme and the plugin must be updated together; updating only one leaves the site exposed. This vulnerability only applies to sites running both components — sites using Avada without Fusion Builder, or vice versa, are not affected by this specific CVE.

This flaw requires no authentication and can be triggered directly against the vulnerable functionality on any site running both components.

Step 1 - Reach the Vulnerable Write Path

An attacker sends a request to the affected Avada/Fusion Builder functionality without any authentication, exploiting the missing authorization check to write a file to the server.

Step 2 - Execute Arbitrary PHP

The attacker writes a malicious PHP file to a web-accessible location and requests it directly, achieving code execution with the privileges of the web server.

Attack Vectors

• Remote, unauthenticated network requests against any site running both Avada and Fusion Builder.
• No user interaction is required, and existing administrator-created content on the site can be enough to satisfy the precondition for exploitation.

Potential Impact

• Write and execute arbitrary PHP code on the web server.
• Achieve full compromise of the WordPress site and, depending on server configuration, the underlying host.

CERTVU recommends the following:

1. Update both Avada and Fusion Builder immediately

   Upgrade Avada to 7.16.1 or later and Fusion Builder to 3.16.1 or later. Both updates are required together.

2. Scan for planted PHP files

   Search the web root and uploads directories for unexpected or recently modified PHP files, particularly outside of the theme and plugin's normal file structure, and remove anything that cannot be accounted for.

3. Review file integrity

   Compare site files against a known-good backup or the official Avada/Fusion Builder release packages to identify unauthorised modifications.

4. Audit the estate for the affected product

   Identify every WordPress site in the organisation running the Avada theme and Fusion Builder plugin, and confirm each has been updated to a patched version.

5. Conduct a compromise assessment

   Where exploitation is suspected, review server access logs, admin user accounts, and scheduled tasks for signs of unauthorised access, and engage incident response support if compromise is confirmed.

For further detail, see BleepingComputer: Critical Avada WordPress Theme Flaw Enables Zero-Click RCE.