Avada Theme: Zero-Click Remote Code Execution Chain (CVE-2026-18431)

Introduction

Avada, one of the best-selling WordPress themes, and its companion Fusion Builder plugin had a critical vulnerability disclosed as CVE-2026-18431 (CVSS 9.8). Unlike a single-bug flaw, this one chains six separate authorization, input-validation, trust-boundary, and file-handling weaknesses — executed in a specific order — into what researchers are calling a zero-click remote code execution attack. An unauthenticated attacker can use the chain to place an attacker-controlled PHP file on the server and then run it, with no login and no victim interaction required.

Affected versions are Avada up to 7.16 and Fusion Builder up to 3.16. ThemeFusion released fixes on August 25, 2026 — Avada 7.16.1 and Fusion Builder 3.16.1.

What You Should Do Right Now

1. Check your Avada and Fusion Builder versions under Appearance and Plugins in wp-admin.
2. Back up your site immediately before updating — a theme update touches more of your site than a typical plugin update.
3. Update both Avada to 7.16.1+ and Fusion Builder to 3.16.1+, then confirm both updated versions are actually active.
4. Check for unfamiliar PHP files in your uploads directory and theme folders.
5. Review your admin user list for any account you don’t recognize — successful exploitation can be used to add rogue admins.

Why “Zero-Click” and “Chained” Bugs Deserve Extra Attention

A single validation bug is often relatively easy to patch and reason about. A six-step chain that has to execute in a specific order is harder to spot in code review and harder to defend against with a single fix — which is exactly why it took multiple coordinated changes across both Avada and Fusion Builder to close it. “Zero-click” means there’s no phishing link, no tricking an admin into clicking something; the vulnerability is reachable directly, on its own, which is what makes it so attractive to automated scanning tools the moment it becomes public.

FAQ

Do I need Fusion Builder installed separately, or is it part of Avada?
Fusion Builder ships alongside Avada but is tracked and updated as its own plugin — check both version numbers separately in wp-admin.

The advisory mentions “certain administrator-authored content” is required — what does that mean for me?
The exact preconditions are detailed in the vendor and researcher advisories; the safest approach is to update regardless of whether you believe your specific content triggers the chain.

How do I check for signs of prior compromise?
Look for unfamiliar PHP files in your uploads and theme directories, unexpected admin accounts, and any unusual redirects on your site.

Conclusion

A six-step, zero-click RCE chain in one of WordPress’s most widely used themes is a top-priority update. Patch both Avada and Fusion Builder, back up first, and check for signs your site was already touched.