A severe security vulnerability, rated 9.8 critical, has been identified in the widely used **Avada** theme for **WordPress**, affecting over a million installations. The flaw, designated **CVE-2026-18431**, is a complex chain of six security issues that, when exploited in sequence, enables unauthenticated attackers to achieve zero-click remote code execution (RCE). ### The Vulnerability Chain Researchers at **Defiant's Wordfence** team uncovered this intricate attack vector. It involves a series of exploits targeting authorization, input-validation, trust-boundary, and file-handling weaknesses. The successful execution of this chain allows an attacker to run arbitrary PHP code on the server, granting them extensive control over the compromised website. ### Impact of Exploitation Should attackers successfully exploit **CVE-2026-18431**, they could fully compromise affected websites. This level of access enables a range of malicious activities, including planting malware, accessing sensitive databases, redirecting visitors to malicious sites, or creating rogue administrator accounts. ### Affected Versions and Fixes The vulnerability impacts **Avada** versions up to 7.16 and **Fusion Builder** plugin versions up to 3.16. **ThemeFusion**, the developer behind **Avada** and **Fusion Builder**, has since released patches. Users are strongly advised to update to **Avada 7.16.1** and **Fusion Builder 3.16.1** immediately to mitigate the risk. ### Disclosed Attack Steps While **Wordfence** is withholding full technical details to provide administrators sufficient time to update, they have provided an overview of the six-step attack chain: 1. Exposing attacker-controlled input through a public request 2. Passing that input to functionality restricted from anonymous users 3. Invoking a privileged component outside its intended context 4. Using request data to influence trusted state 5. Accessing an insufficiently protected administrative operation 6. Bypassing file-handling restrictions on what could be written and where Exploitation requires both a vulnerable version of the **Avada** theme and the **Fusion Builder** plugin to be active. Given that **Fusion Builder** is a required plugin for **Avada**, all sites running the theme are potentially vulnerable. ### Discovery and Disclosure Timeline **Wordfence** discovered this critical flaw on July 30 using their internal agentic framework, **Argus**, which also developed proof-of-concept exploit code in approximately two hours. The full details were shared with **ThemeFusion** on August 5. The vendor acknowledged the report on August 10 and released the necessary fixes on August 26.