If your site runs the Avada theme, stop reading this introduction and go update it first. Avada 7.16.1 and Fusion Builder 3.16.1 were released on August 26, 2026. They fix a critical vulnerability that lets an unauthenticated attacker execute arbitrary PHP code on your server without any interaction from you or your visitors.
That’s as bad as WordPress vulnerabilities get.
What Happened
Wordfence’s security research team discovered a chain of six individual weaknesses across the Avada theme and its bundled Fusion Builder plugin. The full technical breakdown is in Wordfence’s report on BleepingComputer. On their own, none of the six flaws are necessarily catastrophic. Chained together in a specific sequence, they create a path for an unauthenticated attacker to run arbitrary PHP code on the server. No login required. No admin click required. No user interaction at all.
The vulnerability is tracked as CVE-2026-18431 and carries a CVSS score of 9.8 out of 10. That puts it in the critical tier. The six weaknesses span authorisation failures, input validation gaps, trust boundary issues, and file handling problems.
The attack entry point is an AJAX endpoint called fusion_get_widget_markup, which the Fusion Builder plugin registers as accessible to unauthenticated users. The endpoint is protected by a nonce, but that nonce is leaked on any public page rendering a Post Cards or Table of Contents element. Once an attacker has the nonce, the rest of the chain follows.
A successful exploit gives an attacker full control: they can plant malware, access your database, add rogue admin accounts, redirect visitors to malicious sites, or use your server as infrastructure for further attacks.
How It Was Found
The discovery is itself a notable part of this story.
Wordfence found the six-step vulnerability chain using an internal AI-assisted research framework called Argus. The same framework built a working proof-of-concept exploit. The total time: about two hours.
That’s a meaningful data point for anyone thinking about the pace at which vulnerability research is changing. A complex multi-step exploit chain that might have taken a skilled researcher days or weeks was found, reproduced, and weaponised by an AI system in an afternoon.
Wordfence disclosed the full details to ThemeFusion on August 5. ThemeFusion acknowledged on August 10 and shipped the fix on August 26.
Who Is Affected
Avada has sold over one million licences on ThemeForest, making it one of the most commercially successful WordPress themes ever. The vulnerability affects Avada versions up to 7.16 and Fusion Builder versions up to 3.16.
One important caveat: exploitation requires both Avada and Fusion Builder to be running on the same site at the same versions. Since Fusion Builder ships bundled with Avada and both are typically updated together, any site on Avada 7.16 or earlier is vulnerable.
What to Do
Update immediately. Go to WordPress admin → Appearance → Themes and update Avada to 7.16.1. Then go to Plugins and update Fusion Builder to 3.16.1.
If you’re using a hosting provider that runs Imunify360 or a web application firewall, those layers provide some protection against exploit attempts, but they’re not a substitute for patching. Wordfence published detection rules for the exploit chain on its end, but the most reliable fix is the update.
If you’re managing client sites on Avada, this is a same-day job.
A Broader Point About Premium Themes
The honest view from where TopSiteHosters sits: heavy theme frameworks like Avada have always carried more attack surface than a lightweight custom theme. Avada ships with a page builder, a drag-and-drop editor, a patcher system, dozens of shortcodes, and hundreds of template options. Each of those components is code. Each piece of code is a potential entry point.
TSH itself is built on a custom lightweight theme without a commercial theme framework. That’s a deliberate choice. Not because commercial themes are bad, but because every layer of third-party code you add is a layer you don’t fully control. When a vulnerability like CVE-2026-18431 surfaces, the sites that are exposed are the ones where the theme is doing the most work.
That’s not a criticism of Avada specifically. ThemeFusion responded promptly, the patch arrived well within a reasonable window, and the Wordfence team did exactly what responsible disclosure should look like. The point is more general: the more a theme does, the more it can be made to do by someone you didn’t invite.
If you’re choosing a theme for a new site, simpler is often more secure. If you’re already on Avada, the answer for today is simple: update, then keep updating.
Quick Summary
- CVE: CVE-2026-18431
- CVSS: 9.8 (critical)
- Affects: Avada up to 7.16, Fusion Builder up to 3.16
- Fixed in: Avada 7.16.1 and Fusion Builder 3.16.1 (released August 26, 2026)
- Risk: Unauthenticated remote code execution, full site compromise
- Action: Update both Avada and Fusion Builder now
For general WordPress hardening beyond keeping themes updated, the WordPress security guide covers the practical steps worth taking on any site. If your hosting provider includes CloudLinux with CageFS enabled, the filesystem isolation it provides limits what a successful exploit can actually access, but it’s not a patch replacement.
