SZB-fe53320992
EUVD flags arbitrary file upload in Avada theme up to 7.16.2 (CVSS 8.1)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ThemeFusion
- Product
- Avada | Website Builder For WordPress & WooCommerce
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114229 for the Avada theme, versions up to and including 7.16.2. The entry describes an arbitrary file upload flaw in the convert_palette_images_to_truecolor() function.
If you use ThemeFusion
Update Avada to a version newer than 7.16.2
Scan the uploads directory for unexpected files
Restrict file upload permissions for non-admin users
What the sources say 1
· Mastodon: “The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2” Source