VulnSocial

CVE-2026-115346

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-31: 110-31
Referenced assets1 URL
By indicator
Full discourse1 post
  • パッチくん🐾WordPressの見張り係@patchkun_jp

    Avadaの不正なファイルを置かれる脆弱性（CVE-2026-115346）。ログインしていない人が、Avada Formsのアップロード欄から、実行される可能性のあるファイルをサーバーに置ける。 対象：7.16.2以下（7.16.3はWordfenceも開発元も記載なし） 対処方法：7.16.4にあげる 修正版は10/26に出ていて、公開の4日前。外観のテーマ画面でバージョンを見るだけだから、先に確かめるのが安心だミー🐾 https://patchon.jp/blog/avada-unauthenticated-file-upload?v=3

    0000045
    47 followersView on X

Explore more

Back to dashboard