Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
Affects Avada 7.16.2 and earlier sites that use Avada Forms upload fields. CVSS rates it high (8.1), and no vendor severity rating is given. Fixed in 7.16.4.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 7.16.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Avada theme for WordPress and WooCommerce, a popular website builder, is affected by this flaw. An unauthenticated attacker could upload arbitrary files, potentially including executable code, which could allow them to run remote code on the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
through 7.16.2
References 3
Questions about CVE-2026-115346
What does this mean?
The vulnerability is in the upload fields of Avada Forms, where a possible remote code execution flaw was found. The advisory describes the issue as a possible remote code execution vulnerability in those fields.Source: avada.com
Am I affected, and how do I check?
Avada versions up to and including 7.16.2 are in the affected range, and the affected feature is Avada Forms upload fields. To check, look at the installed Avada version and whether the site uses an Avada Forms upload field.Source: avada.com
What should I do about it?
Upgrade Avada to 7.16.4, which the vendor released as the fix for this issue.Source: avada.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data