Critical Avada Theme Vulnerability for WordPress: Zero-Click RCE

Researchers from the Wordfence team (Defiant) have disclosed a critical vulnerability in the popular Avada theme for WordPress. A chain of six separate flaws makes a zero-click attack possible: an unauthenticated attacker can achieve arbitrary PHP code execution on the server without any interaction from the victim.

Collectively, the issue is tracked as CVE-2026-18431 and has received the highest possible severity score — 9.8. The attack combines weaknesses in authorization, input validation, trust boundaries and file handling, and the exploits must be run in a strictly defined order.

How the chain works

Wordfence is not publishing full technical details, so as to give administrators time to update, and limits itself to a general description of the steps: disclosure of attacker-controlled input through a public request; passing that data into functionality closed to anonymous users; invoking a privileged component outside its intended context; influencing trusted state through request data; accessing an insufficiently protected administrative operation; and, finally, bypassing file-write restrictions.

Successful exploitation gives the attacker full control over the site: everything from installing malware and accessing databases to redirecting visitors and creating hidden administrator accounts.

Who is at risk

The vulnerability affects Avada versions up to and including 7.16 and the Fusion Builder plugin up to 3.16. Even though the Avada theme is quite popular — more than a million copies sold — exploitation requires the simultaneous presence of both the vulnerable theme and an active Fusion Builder plugin. That condition noticeably narrows the pool of potential targets.

Developer ThemeFusion has released fixes in Avada 7.16.1 and Fusion Builder 3.16.1. Users are advised to update immediately.

The vulnerability was found by AI

How the issue was discovered deserves particular attention. Wordfence uncovered the six-link chain using its own agentic AI framework, called Argus. The tool not only found the vulnerability but also independently developed a working proof-of-concept — and all of it took about two hours.

According to the published timeline, Argus discovered and reproduced the vulnerability on July 30, the details were passed to the developer on August 5, ThemeFusion confirmed receipt of the report on August 10, and the fixes were released the day before publication.

Source: Bleeping Computer