Avada Theme / Fusion Builder unauthenticated RCE chain
A six-flaw exploit chain in ThemeFusion's Avada theme and Fusion Builder plugin lets unauthenticated attackers execute arbitrary PHP on the server. CVSS 9.8 Critical. Patch to Avada 7.16.1 and Fusion Builder 3.16.1.
- Vendor
- ThemeFusion
- Product
- Avada WordPress theme (≤ 7.16) and Fusion Builder plugin (≤ 3.16)
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.0%
- Status
- patched
- Published
Is CVE-2026-18431 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-18431 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 15, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
ThemeFusion’s flagship WordPress theme Avada and its companion Fusion Builder plugin carry a six-vulnerability chain (CVE-2026-18431, CVSS 9.8) that allows unauthenticated remote code execution. Exploitation requires both products to be active simultaneously — the chain combines an authorization bypass, an input-validation flaw, a trust-boundary violation, and a file-handling restriction bypass to land arbitrary PHP code on the server.
Affected versions: Avada ≤ 7.16 and Fusion Builder ≤ 3.16 when both are active.
Fixed versions: Avada 7.16.1 and Fusion Builder 3.16.1, released August 26, 2026.
No known active exploitation has been reported at the time of disclosure, but CVSS 9.8 unauthenticated RCE on a widely deployed theme is a high-value target.
Recommended action: Update both components immediately. WordPress sites running Avada without Fusion Builder active are not vulnerable to this specific chain, but updating either way closes the individual flaws.
