Security Alert Summary
The Avada theme for WordPress and the Fusion Builder plugin are affected by an arbitrary file write vulnerability that can be reached without authentication when both components are installed and active. The issue stems from a chain of authorization and input validation weaknesses across Avada and Fusion Builder, allowing an attacker to write attacker-controlled files to the server. Successful exploitation can lead to creation and execution of arbitrary PHP files, resulting in remote code execution and full site compromise when specific administrator-authored content is present.
CVE Details
- CVE ID: CVE-2026-18431
- Affected component(s): Avada | Website Builder For WordPress & WooCommerce; Avada (Fusion) Builder (Fusion Builder plugin)
- Affected versions:
- Avada | Website Builder For WordPress & WooCommerce: versions up to and including 7.16
- Avada (Fusion) Builder (Fusion Builder plugin): versions up to and including 3.16
- Published: August 26, 2026 at 07:16:45 AM UTC
- Last modified: August 26, 2026 at 04:19:05 PM UTC
- CVSS v3.1: Base score 9.8, CRITICAL; vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness ID: CWE-862
Technical Details
This vulnerability is an arbitrary file write resulting from a chain of authorization and input validation weaknesses across the Avada theme and the Fusion Builder plugin. The components fail to adequately validate inputs and enforce authorization checks in the relevant integration points, which allows unauthenticated attackers to write attacker-controlled files to the web server.
An attacker who can write files to the server can create PHP files and execute them, which may lead to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active on the same site, and certain administrator-authored content to be present. No specific functions or REST endpoints are named in the available data.
How This Could Impact Your Website
On a typical WordPress site with multiple users, the presence of both Avada and Fusion Builder creates an attack surface where an unauthenticated outsider could write files to your site under the conditions described. In a realistic scenario, an attacker could place PHP web shells or other malicious files that allow remote execution, which could be used to access or modify site data and files maintained by the site owner, internal staff, or external contractors.
Practical consequences include exposure of internal user information such as email addresses, increased risk of targeted phishing or social engineering against site staff or contractors, and unauthorized changes to site content or configurations. If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected Avada theme and Fusion Builder plugin as soon as patched versions are made available.
- Review and reduce unnecessary user roles, especially contributors and any accounts with administrative privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site activity and logs for unusual behavior, file changes, or unexpected PHP files appearing in web-accessible directories.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
