WordPress Avada theme chain allows unauthenticated code execution

A chain of six vulnerabilities in the Avada WordPress theme and Fusion Builder plugin allows unauthenticated attackers to execute arbitrary PHP code. The flaws, tracked as CVE-2026-18431 with a critical severity score of 9.8, affect Avada up to 7.16 and Fusion Builder up to 3.16. Wordfence discovered the issue using its Argus framework, and fixes are available in versions 7.16.1 and 3.16.1.

The vulnerability chain was discovered using Wordfence's Argus framework, an internal agentic system that identified and reproduced the flaw in roughly two hours on July 30. ThemeFusion received the report on August 5, acknowledged it on August 10, and released patched versions yesterday. The researchers withheld full technical details to allow administrators time to update.

The attack requires both the Avada theme and Fusion Builder plugin to be vulnerable versions active on a target site. While Avada has sold over one million copies, this dual prerequisite narrows the pool of exploitable targets considerably. The six-step chain spans authorization, input-validation, trust-boundary, and file-handling weaknesses that must be executed in sequence.