VulnerabilitiesCritical Avada WordPress theme flaw lets attackers hijack sites with no clicks
A six-step bug chain in the popular Avada theme and Fusion Builder plugin, tracked as CVE-2026-18431, hands unauthenticated attackers full control of vulnerable WordPress sites.