CVE-2026-18431, a vulnerability chain scored 9.8 out of 10 for critical severity, can be chained into a zero-click remote code execution that lets an unauthenticated attacker run arbitrary PHP on affected WordPress sites.
What the flaw is and what it enables
Researchers at Defiant's Wordfence team report that CVE-2026-18431 is not a single bug but a six-step chain of weaknesses in the Avada WordPress theme and the Fusion Builder plugin. When the chain is executed in order, the researchers say, an unauthenticated attacker can execute arbitrary PHP code on the server. Successful exploitation would allow attackers to fully compromise a site — planting malware, accessing databases, redirecting visitors to malicious sites, or adding rogue administrator accounts, the report states.
The six-step attack chain, as outlined by Wordfence
- Exposing attacker-controlled input through a public request
- Passing that input to functionality restricted from anonymous users
- Invoking a privileged component outside its intended context
- Using request data to influence trusted state
- Accessing an insufficiently protected administrative operation
- Bypassing file-handling restrictions on what could be written and where
Wordfence says these authorization, input-validation, trust-boundary and file-handling weaknesses must be exploited in a specific order for arbitrary PHP execution to succeed. To limit detailed exploitation guidance being widely available, the researchers withheld full technical details so administrators would have time to apply fixes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAffected products and how common they are
The flaw affects Avada theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16, according to the Wordfence report. Avada is described as popular, with more than 1 million sales; however, Wordfence cautions that exploitation requires a vulnerable version of both the theme and the Fusion Builder plugin to be active on the same site, a prerequisite that significantly narrows the pool of potential targets.
Discovery, disclosure and remediation timeline
Wordfence's internal agentic framework Argus discovered the six-step chain and produced proof-of-concept exploit code in roughly two hours, the researchers say. Argus found and reproduced the flaw on July 30, the team shared full details with ThemeFusion on August 5, and ThemeFusion acknowledged the report on August 10. ThemeFusion released fixes in Avada 7.16.1 and Fusion Builder 3.16.1 yesterday, the report states.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: Wordfence's decision to withhold full technical details was explicitly made to give administrators time to install the vendor fixes. The concrete action item in the record is that fixes are available in Avada 7.16.1 and Fusion Builder 3.16.1.
- Affected enterprises and procurement leaders: Because exploitation requires both a specific theme version and a specific plugin version to be present, procurement and inventory controllers should verify whether sites use Avada up to 7.16 together with Fusion Builder up to 3.16 to understand exposure.
- Adversaries and threat actors: The Wordfence account shows that the chain can be assembled from multiple, distinct weaknesses — authorization, input validation, trust-boundary and file-handling — and that automated tooling (Argus) produced proof-of-concept exploit code quickly, underscoring how combinations of modest flaws can be elevated into high-impact attacks.
Wordfence also notes a broader operational point: overall prevention scores can hide what happens after initial access. "Once attackers are using valid credentials, prevention drops sharply," the report observes. The Blue Report 2026, cited by the researchers, measures defenses technique-by-technique across 338 million simulations run in customer production environments — a reminder, in Wordfence's framing, that initial compromise is only the start of risk.
ThemeFusion and Wordfence have moved through discovery, disclosure and mitigation on a compact timeline; the fix is now published in Avada 7.16.1 and Fusion Builder 3.16.1. For site owners and administrators who run the affected components together, the facts in the record are simple and binary: the vulnerability chain exists, it requires both vulnerable components, and vendor fixes are available.
