A critical six-step vulnerability chain in the Avada WordPress theme and Fusion Builder plugin can let an unauthenticated attacker execute arbitrary PHP code on affected servers. ThemeFusion has released fixes for CVE-2026-18431, and administrators should urgently update because successful exploitation could lead to website takeover, database access, malware deployment, and malicious redirects. #Avada #FusionBuilder #CVE202618431 #WordPress
Keypoints
- CVE-2026-18431 is a critical 9.8-rated vulnerability chain in Avada and Fusion Builder.
- An unauthenticated attacker can chain six flaws to execute arbitrary PHP code.
- The attack abuses authorization, input-validation, trust-boundary, and file-handling weaknesses.
- Exploitation can enable website compromise, database theft, rogue admin accounts, and malicious redirects.
- The issue affects Avada up to 7.16 and Fusion Builder up to 3.16, with fixes in Avada 7.16.1 and Fusion Builder 3.16.1.