Avada zero-click RCE chain (CVE-2026-18431) and a separate Fusion Builder XSS: what WordPress admins should know

A widely used WordPress theme and its companion builder plugin were recently in the spotlight for two different security issues. According to BleepingComputer, a six-step vulnerability chain in the Avada theme can let an unauthenticated attacker execute arbitrary PHP code on a target server with no user interaction (CVE-2026-18431, rated 9.8 critical). Separately, an NVD entry describes a stored cross-site scripting flaw in the Avada (Fusion) Builder plugin affecting versions up to 3.15.6 (CVE-2026-16654) that requires contributor-level access to exploit.

This post summarizes what’s confirmed, what remains unclear, and the immediate steps administrators can take based on the available evidence.

What we know

BleepingComputer reports that researchers at Defiant’s Wordfence team found a critical attack chain in the Avada theme that can be triggered without any user clicks. The chain strings together six weaknesses spanning authorization, input validation, trust boundaries, and file handling, executed in a specific order to reach arbitrary PHP code execution on the server. The issue is tracked as CVE-2026-18431.

Per the same report, the chain affects Avada theme versions up to 7.16 and also relies on the Fusion Builder plugin versions up to 3.16 being present. Both the theme and the plugin must be active and vulnerable for the attack to work. ThemeFusion has released fixes in Avada 7.16.1 and Fusion Builder 3.16.1. BleepingComputer notes that Wordfence has not shared full technical details yet, to allow administrators time to update.

Separately, an NVD entry describes CVE-2026-16654, a stored XSS in the Avada (Fusion) Builder plugin affecting all versions up to and including 3.15.6. The issue stems from insufficient input sanitization and output escaping in a shortcode attribute, allowing authenticated users with contributor privileges or higher to inject scripts that execute when a page is viewed. The vendor documentation provides a consolidated changelog for Avada and related components.

Sources:

• BleepingComputer: “Critical Avada WordPress theme flaw enables zero-click RCE” — https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
• Vendor documentation (Avada changelog) — https://avada.com/documentation/avada-changelog/

Why it matters

Avada is a high-profile theme with a large install base. While the zero-click RCE chain requires both the theme and the Fusion Builder plugin to be vulnerable and active—reducing the pool of exploitable sites—the potential impact of server-side code execution is severe. The separate stored XSS in Fusion Builder highlights that less-privileged, authenticated users can still pose risk if input handling is fragile.

What to do now

Based on the evidence above, administrators should:

• Identify whether both Avada and the Fusion (Avada) Builder plugin are active, and note their versions.
• Update to the vendor’s fixed releases cited by BleepingComputer:
  • Avada theme: 7.16.1
  • Fusion Builder plugin: 3.16.1
• Review the vendor’s changelog for details on recent fixes and to track any additional advisories: https://avada.com/documentation/avada-changelog/

Because the RCE chain requires vulnerable versions of both components, updating to the fixed versions breaks the attack path as described in the report.

Caveats and open questions

• The BleepingComputer report notes that full technical details of CVE-2026-18431 are being withheld for now; expect more specifics after a reasonable patch window.
• The sources summarized here do not state whether CVE-2026-18431 is being actively exploited in the wild.
• For CVE-2026-16654, the NVD entry lists versions up to 3.15.6 as affected. The evidence packet does not specify the first fixed version for that XSS; administrators should consult the vendor changelog for confirmation.

Staying current with theme and plugin updates remains the most practical way to minimize exposure to both issues.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.