Critical Avada WordPress theme flaw enables zero-click RCE

Researchers at Wordfence have disclosed a critical vulnerability chain, tracked as CVE-2026-18431, that allows unauthenticated attackers to execute arbitrary PHP code on websites using the Avada theme and Fusion Builder plugin. With a CVSS score of 9.8, this zero-click exploit combines six distinct security flaws to compromise the server, enabling actions such as database access or the creation of rogue administrator accounts. A proof-of-concept exploit is now available following discovery by Wordfence’s agentic framework, Argus. ThemeFusion has addressed the issue in recent updates; administrators should immediately upgrade to Avada 7.16.1 and Fusion Builder 3.16.1 to mitigate the risk.