Critical Avada WordPress theme flaw lets attackers hijack sites with no clicks

Key points

• Wordfence disclosed a critical flaw chain in the Avada WordPress theme and Fusion Builder plugin, tracked as CVE-2026-18431, carrying a severity score of 9.8 out of 10.
• The bug lets an attacker who has never logged in run their own code on the web server, with no clicks from any user required.
• Avada versions up to 7.16 and Fusion Builder versions up to 3.16 are vulnerable; ThemeFusion shipped fixes in 7.16.1 and 3.16.1.
• Exploitation needs both the vulnerable theme and the vulnerable plugin active, which narrows the pool of at-risk sites from Avada's million-plus buyers.
• Wordfence found the chain using an in-house AI tool called Argus, which reproduced the attack and wrote proof-of-concept code in around two hours.

A newly disclosed flaw in one of the web's best-selling WordPress themes can hand a stranger on the internet complete control of a site, without anyone clicking a thing.

Researchers at Defiant's Wordfence team, who protect WordPress sites for a living, say the bug chain sits inside the Avada theme and its companion Fusion Builder plugin. Both are made by ThemeFusion. Avada alone has sold more than a million copies.

The issue is tracked as CVE-2026-18431 and rated 9.8 out of 10 for severity. In plain terms: it is about as bad as a web flaw gets.

What can attackers actually do?

They can run their own code on the server that hosts the website. That is called remote code execution, and it is the keys-to-the-kingdom outcome defenders dread.

From there, criminals can plant malware, read the site's database, quietly add themselves as administrators, or redirect visitors to scam pages. The site owner may not notice for weeks.

Because the attack is "zero-click", no admin has to open a booby-trapped email or click a bad link. The attacker just sends web requests to the vulnerable site.

How the attack works, in plain English

Wordfence is holding back the technical detail on purpose, to give site owners time to patch. What they have shared is the shape of the chain: six separate weaknesses, stitched together in a specific order.

The attacker feeds input into a public part of the site, then tricks the software into treating that input as if it came from a trusted, logged-in user. Each step alone is minor. Chained, they end with the attacker writing a file of their choice to a place they should never reach.

One important caveat. Both the vulnerable Avada theme and the vulnerable Fusion Builder plugin must be active on the target site. Sites running only one, or running an updated version, are not exposed to this chain.

Who found it, and when was it fixed?

Wordfence's AI system, an in-house tool called Argus, found the chain and produced working exploit code in roughly two hours on July 30. The researchers reported it privately to ThemeFusion on August 5. ThemeFusion acknowledged the report on August 10 and released patches the day before Wordfence went public, first reported by BleepingComputer.

What should site owners do right now?

Update Avada to 7.16.1 and Fusion Builder to 3.16.1 today. If you pay an agency to run your site, ask them to confirm both versions in writing.

After updating, check the site's list of administrator accounts for names you do not recognise, and review recently uploaded files in the WordPress uploads folder. Those are the two places attackers typically leave a foothold.

Ordinary visitors to Avada-built sites do not need to do anything special. If a site you use starts behaving oddly, redirecting you or asking for logins in unusual places, close the tab and report it to the site owner.