What happened

Heads up, WordPress crowd: a nasty chain of bugs in the popular Avada theme lets an attacker run PHP on your server without you clicking anything. Researchers rated the issue as CVE-2026-18431 with a scary 9.8 severity — in other words, this is not the kind of thing you ignore over coffee.

The problem only shows up when both the Avada theme (versions up to 7.16) and the Fusion Builder plugin (versions up to 3.16) are active on the same site — which is basically every Avada site, because Fusion Builder is required. Avada has sold over a million copies, so the potential target pool is large.

The vendor has pushed fixes (Avada 7.16.1 and Fusion Builder 3.16.1). If you run either component on your site, you should update now.

The six-step nasty (in plain English) and how to protect yourself

This exploit is not a single typo — it’s a precise choreography of six separate flaws that an attacker strings together to achieve full remote code execution. In basic terms, the attacker sneaks malicious input into a public request, escalates privileges, and then writes files where they shouldn’t be able to. Here’s the play-by-play:

  1. Attacker leverages a public-facing endpoint to feed attacker-controlled input into the site.
  2. That input is then handed off to functionality that normally requires a logged-in user, even though the attacker started out unauthenticated.
  3. A privileged component is triggered outside of the safe context it was designed for.
  4. The attack uses request data to change or pollute some trusted internal state.
  5. An administrative operation that should be protected is reached and used.
  6. File-handling rules are bypassed so the attacker can write files (like PHP web shells) where they’re not supposed to, leading to arbitrary code execution.

If that sounds horrible, that’s because it is. The exploit chain requires each step to work in order, but when it does, an attacker can take over the site — plant malware, steal data, add admin accounts, or redirect visitors to nasty places.

What to do right now:

  • Update both Avada and Fusion Builder to the patched releases immediately.
  • If you can’t patch immediately, consider disabling the theme/plugin, or deploy WAF rules to block suspicious requests.
  • Scan your site for newly added admin users, modified files, or web shells and review logs for strange activity since late July.
  • Rotate credentials and check your backups for clean restore points in case you need to roll back.

Researchers found and reproduced the chain quickly using an internal testing framework and disclosed the issue to the vendor; fixes followed shortly afterward. Treat this like a hot potato — update, inspect, and lock things down.