CVE-2026-18431Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
18 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 9 signals
Technical details provided in 16 signals
Disclosure: 10 classified signals
General: 1 classified signal
Peaked 3d ago at 9 mentions (2026-08-27); latest day: 1
18 total mentions across 5 days

Deep dive

Activity timeline18 mentions / 5d

Signal classification4 categories

Disclosure

1055.6%

Patch

633.3%

General

15.6%

PoC

15.6%

Referenced assets18 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-26	3	Disclosure3
2026-08-27	9	Disclosure4General1Patch3PoC1
2026-08-28	3	Disclosure2Patch1
2026-08-31	2	Disclosure1Patch1
2026-09-02	1	Patch1

Full discourse18 posts

Es Geeks@EsGeeks45d
Patch
🚨 Avada WordPress: RCE zero-click sin login (CVE-2026-18431). Cadena de 6 fallos permite escribir PHP arbitrario. Actualiza YA a 7.16.1 + Fusion Builder 3.16.1. #WordPress #RCE #Ciberseguridad Fuente: BleepingComputer - https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/ https://t.co/Lgav9uL9ym
Post summary
CVE-2026-18431 in the Avada WordPress theme enables a zero‑click remote code execution via a 6‑step chain; users are urged to update to version 7.16.1 and Fusion Builder 3.16.1 immediately, with no evidence of current widespread exploitation.
11071769
22.5K followersView on X
Daily CyberSecurity@Daily_CyberSec45d
Disclosure
Wordfence's AI system Argus uncovered a six-step vulnerability chain in the Avada WordPress theme, rated 9.8 critical, enabling unauthenticated remote code execution. #Avada #CVE202618431 #WordPress #Wordfence #FusionBuilder https://securityexpress.info/avada-theme-cve-2026-18431-rce/
Post summary
Wordfence’s AI system uncovered a critical, 9.8‑rated remote code execution vulnerability chain in the Avada WordPress theme, but no exploitation evidence or mitigation details have been released yet.
03040601
13.0K followersView on X
SOCRadar®@socradar45d
Disclosure
Critical vulnerability alert: CVE-2026-18431 affects Avada WordPress theme + Fusion Builder. → CVSS 9.8 → Unauthenticated RCE possible → Arbitrary PHP file write/execution → No confirmed exploitation yet Patch now: Avada 7.16.1+ | Fusion Builder 3.16.1+ Learn more:https://hubs.la/Q04vvh_K0 #WordPress #RCE #CyberSecurity #Vulnerability
Post summary
The post announces a critical RCE vulnerability (CVE-2026-18431) affecting Avada WordPress theme and Fusion Builder, provides CVSS details, and lists patch versions, noting no confirmed exploitation to date.
10041744
7.1K followersView on X
connect24h@connect24h45d
Patch
売れたテーマほど、穴の半径もでかい。 AvadaとFusion Builderの脆弱性チェーンで、未認証のzero-click RCEが成立するとWordfenceが報告した。CVE-2026-18431、記事記載のCVSSは9.8。Avada 7.16以前とFusion Builder 3.16以前が影響対象とされ、修正版は7.16.1／3.16.1。100万件超の販売実績と稼働サイト数は別だが、管理外WordPressを抱える側としては他人事に見えない。6段階の攻撃経路と開示経緯は元記事へ。ただしPoCや一次資料は非公開で、RCE成立とCVSSは現時点で独立検証できない。人気は安全の証明ではなく、攻撃者から見れば市場規模にもなる。ソース: https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
Post summary
A zero‑click RCE in Avada and Fusion Builder (CVE-2026-18431, CVSS 9.8) has been disclosed and patched in newer releases, though PoC details remain unpublished.
00120664
8.3K followersView on X
National CERT/CC@CERT_UG41d
Patch
🚨 Patch Now | August 31, 2026 Bringing these patches to your attention. - cPanel (CVE-2026-65643) - Oracle WebLogic (CVE-2026-21962, CVSS 10.0) - Avada WordPress Theme (CVE-2026-18431, CVSS 9.8) https://cert.ug | #CyberSafeUG #CERTUGCC https://t.co/R87BUwfN5r
Post summary
The tweet serves as a patch reminder, listing multiple CVEs with high CVSS scores and urging users to apply the updates.
01010124
1.5K followersView on X
Phil_Taboada@Phil2427544339d
Patch
Si tu web usa Avada (el tema de WordPress) en 7.16 o menos, alguien de afuera puede meterse al servidor sin tener usuario. El parche 7.16.1 salió el 25 ago. Revisa la versión esta semana. https://www.wavys-technologies.com/es/blog/avada-wordpress-cve-2026-18431
Post summary
Una advertencia sobre CVE‑2026‑18431 expone que las versiones 7.16 y anteriores del tema Avada pueden permitir acceso no autorizado al servidor; el parche 7.16.1 se publicó el 25 agosto y se recomienda actualizar.
0000040
3 followersView on X
SecAlerts@SecAlertsCo41d
Disclosure
Vulns in WordPress plugins and themes. CVE-2026-82222, CVSS 10 - https://secalerts.co/vulnerability/CVE-2026-82222 CVE-2026-76581 - https://secalerts.co/vulnerability/CVE-2026-76581 CVE-2026-18431 - https://secalerts.co/vulnerability/CVE-2026-18431 CVE-2026-19632 - https://secalerts.co/vulnerability/CVE-2026-19632 CVE-2026-19598 - https://secalerts.co/vulnerability/CVE-2026-19598 #ciso #cio #cto #msp #mssp https://t.co/ILSfPKqogV
Post summary
The tweet announces multiple WordPress plugin and theme vulnerabilities, lists their CVE identifiers along with CVSS scores, and provides links to detailed advisory pages.
00000166
885 followersView on X
CVETodo@CveTodo44d
Disclosure
A critical vulnerability chain in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on any server running the affected software — no user interaction required. https://cvetodo.com/news/critical-zero-click-rce-flaw-cve-2026-18431-found-in-avada-wordpress-theme-affecting-over-1-million- #WordPress #RCE #CriticalVulnerability #CVE #InfoSec https://t.co/dvZCeT7kl9
Post summary
The tweet announces a critical zero‑click RCE flaw (CVE‑2026‑18431) in the Avada WordPress theme that allows unauthenticated execution of arbitrary PHP code without user interaction.
0000093
19 followersView on X
SecAlerts@SecAlertsCo45d
Patch
🖊️ Avada theme (WordPress) - unauthenticated RCE via arbitrary file write. CVE-2026-18431 scores CVSS 9.8. No auth, no interaction needed. Affects Avada <=7.16 + Fusion Builder <=3.16. Patch now. #cybersecurity #ciso #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-18431?utm_campaign=x https://t.co/y6CXRRwzk1
Post summary
The tweet discloses CVE-2026-18431 as an unauthenticated RCE in the Avada WordPress theme, highlights its high severity, and urges users to apply the available patch immediately.
00000112
882 followersView on X
SecAlerts@SecAlertsCo45d
Disclosure
Vuln chain in Avada WordPress theme allows unauthenticated attacker to execute arbitrary PHP code. Info, incl. fix info, now at #SecAlerts: CVE-2026-18431, CVSS 9.8 - https://secalerts.co/vulnerability/CVE-2026-18431 #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp #CVE202618431 #WordPress https://t.co/Ka8GOEq7ja
Post summary
A vulnerability chain in the Avada WordPress theme that allows unauthenticated arbitrary PHP code execution has been disclosed (CVE‑2026‑18431, CVSS 9.8), with fix information linked in the tweet.
00000163
882 followersView on X
SempreUpdate@SempreUpdate45d
General
Falha crítica no tema Avada expõe sites WordPress a ataques https://sempreupdate.com.br/falha-critica-tema-avada-wordpress-cve-2026-18431/
Post summary
The text reports a critical vulnerability in the Avada WordPress theme that could expose sites to attacks, but it lacks any technical specifics, exploit code, or mitigation details.
00000127
4.7K followersView on X
LinuxTuts@LinuxTuts12345d
Patch
🚨 CRITICAL WORDPRESS ALERT 🚨 Zero-click, unauthenticated RCE (CVE-2026-18431, CVSS 9.8) found in the Avada theme & Fusion Builder. Over 1 MILLION sites are exposed to complete takeover. If you run Avada < 7.16.1 or Fusion Builder < 3.16.1, you are a sitting duck. Update NOW. 🛑 #WordPress #CyberSecurity #CVE #InfoSec
Post summary
Avada Theme and Fusion Builder are vulnerable to a zero‑click, unauthenticated RCE (CVE‑2026‑18431, CVSS 9.8). Over one million sites are exposed; users of affected versions must update immediately.
0000095
18 followersView on X
Cybersecurity News DE@cybsecuritynews45d
Disclosure
#schwachstellen CVE-2026-18431: Avada und Fusion Builder erlauben Dateischreiben bis hin zur RCE #avada #cve202618431 #fusionbuilder #wordpress https://cybersecurity-news.de/cve-2026-18431-avada-fusion-builder-arbitrary-file-write-rce
Post summary
The post announces that Avada and Fusion Builder plugins contain a file‑write flaw capable of leading to remote code execution.
0000050
10 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX45d
PoC
🤖⚠️ AI SECURITY + APPSEC: An autonomous security framework found a SIX-STAGE unauthenticated RCE chain in one of the world's most popular WordPress themes — in roughly TWO HOURS. Target: AVADA More than: 1 MILLION SALES. Vulnerability: CVE-2026-18431 CVSS 9.8 CRITICAL CyberSignal Priority: 🔴 VERY HIGH 📅 August 26–27, 2026 🏷️ WordPress · AI Security · RCE · AppSec · Autonomous Vulnerability Research 🔬 Research: Wordfence Argus This story isn't only about another WordPress vulnerability. It's also about what happens when AI starts performing: MULTI-STEP EXPLOIT RESEARCH. --- ### 💥 Six weaknesses had to be chained The vulnerability affects: Avada ≤ 7.16 with: Fusion Builder ≤ 3.16. Successful exploitation can allow an unauthenticated attacker to: write attacker-controlled files ↓ create PHP code ↓ execute it on the server ↓ completely compromise the WordPress site. No account required. No victim click required. But the path is not one simple bug. Wordfence says the exploit required: SIX separate weaknesses involving: authorization input validation trust boundaries privileged behavior and: file handling. Every link had to be chained correctly. --- ### 🤖 An AI system found the entire chain Wordfence developed an agentic security framework called: ARGUS. Argus discovered the issue on: July 30. Then: identified the six-stage path ↓ constructed the chain ↓ reproduced the vulnerability ↓ proved end-to-end RCE in roughly: TWO HOURS. That is the part defenders should pay attention to. Multi-stage exploitation has traditionally required: skilled human researchers + large amounts of manual reverse engineering + time. Agentic systems are beginning to compress that process dramatically. --- ### ⚠️ Exploitation conditions matter Successful exploitation requires: Avada AND: Fusion Builder to be installed and active plus: certain administrator-authored content. However, Fusion Builder is a required component of normal Avada deployments. So defenders should not assume: “our site probably doesn't have the plugin.” Check. --- ### 🛡️ Patched versions ThemeFusion released fixes on: August 25. Update to: Avada 7.16.1+ and: Fusion Builder 3.16.1+. There is currently no confirmed mass exploitation publicly disclosed. So this is: ⚠️ CRITICAL SECURITY UPDATE —not: 🚨 ACTIVE EXPLOITATION. --- ### 🧠 The bigger story is AI vulnerability discovery This is where offensive and defensive AI begin converging. AI can already: read source code compare patches generate hypotheses build test cases run exploitation attempts and: iterate autonomously. Now it is starting to connect weaknesses across: multiple components and build: multi-stage exploit chains. That changes the vulnerability-disclosure race. Yesterday: researcher ↓ days/weeks of analysis ↓ exploit. Increasingly: agent ↓ parallel reasoning ↓ automated testing ↓ hours. The important question for defenders becomes: If AI can find a six-stage RCE chain in two hours... how quickly can attackers do the same after every patch? Sources: Wordfence · ThemeFusion/Avada · BleepingComputer #AISecurity #WordPress
Post summary
AI‑driven research uncovered a six‑stage unauthenticated RCE chain in the Avada WordPress theme (CVE‑2026‑18431, CVSS 9.8); a PoC was demonstrated, patches are available, and no active exploitation has been reported.
00000144
126 followersView on X
Abijita Foundation@OfficialAbijita45d
Disclosure
Critical Avada WordPress Flaw Enables Zero-Click Remote Code Execution https://www.abijita.com/avada-wordpress-theme-critical-rce-cve-2026-18431/
Post summary
The article announces a critical zero‑click remote code execution flaw in the Avada WordPress theme (CVE‑2026‑18431), providing basic technical details but no exploitation or mitigation information.
0000049
517 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Disclosure
CVE-2026-18431 - Critical Unauthenticated RCE in WordPress Avada theme & Fusion Builder via arbitrary file write. CVSS 9.8. Unpatched. Mitigate immediately. #CVE #WordPress #cybersecurity https://www.valtersit.com/cve/CVE-2026-18431 #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker
Post summary
The tweet announces that CVE-2026-18431—an unauthenticated RCE in WordPress Avada theme via arbitrary file write—is critical (CVSS 9.8) and unpatched, urging immediate mitigation.
0000059
1.0K followersView on X
ThreatAft@ThreatAft46d
Disclosure
🔐🚨 Avada WordPress Theme — CVSS 9.8 CRITICAL CVE-2026-18431: Unauthenticated arbitrary file write → RCE → #1 selling WP theme (900K+ sales) → https://threataft.com/articles/avada-wordpress-theme-cve-2026-18431-rce #cybersecurity #infosec #WordPress #Avada #RCE #CVSS9 #PatchNow #ThreatIntel
Post summary
The tweet announces the critical CVE‑2026‑18431 vulnerability in the Avada WordPress theme, noting an unauthenticated arbitrary file write that enables RCE, and directs readers to an external article for more details.
0000054
37 followersView on X
LoreleiWeb@LoreleiWeb46d
Disclosure
🆕👉 Avada https://wpdeeply.com/avada-7-16-fusion-builder-3-16-unauthenticated-rce/ #loreleiweb Wordfence published CVE-2026-18431 on August 25, 2026 for Avada, the commercial WordPress theme, when used with its bundled Fusion Builder plugin. The impact is critical: an unauthenticated attacker can chain multiple weaknesses … https://t.co/SVommZvCWg
Post summary
Wordfence has published CVE‑2026‑18431 for the Avada WordPress theme, highlighting a critical unauthenticated RCE that can chain weaknesses; the linked article likely contains PoC details, but no active exploitation or patch information is provided.
00000201
85.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-18431

SOCRadar®[verified]@socradarDisclosure

The post announces a critical RCE vulnerability (CVE-2026-18431) affecting Avada WordPress theme and Fusion Builder, provides CVSS details, and lists patch versions, noting no confirmed exploitation to date.

connect24h[verified]@connect24hPatch

A zero‑click RCE in Avada and Fusion Builder (CVE-2026-18431, CVSS 9.8) has been disclosed and patched in newer releases, though PoC details remain unpublished.

SempreUpdate[verified]@SempreUpdateGeneral

The text reports a critical vulnerability in the Avada WordPress theme that could expose sites to attacks, but it lacks any technical specifics, exploit code, or mitigation details.

LinuxTuts[verified]@LinuxTuts123Patch

Avada Theme and Fusion Builder are vulnerable to a zero‑click, unauthenticated RCE (CVE‑2026‑18431, CVSS 9.8). Over one million sites are exposed; users of affected versions must update immediately.

CyberSignal | Cybersecurity News[verified]@XQOPTRXPoC

AI‑driven research uncovered a six‑stage unauthenticated RCE chain in the Avada WordPress theme (CVE‑2026‑18431, CVSS 9.8); a PoC was demonstrated, patches are available, and no active exploitation has been reported.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The tweet announces that CVE-2026-18431—an unauthenticated RCE in WordPress Avada theme via arbitrary file write—is critical (CVSS 9.8) and unpatched, urging immediate mitigation.

Es Geeks@EsGeeksPatch

CVE-2026-18431 in the Avada WordPress theme enables a zero‑click remote code execution via a 6‑step chain; users are urged to update to version 7.16.1 and Fusion Builder 3.16.1 immediately, with no evidence of current widespread exploitation.

Daily CyberSecurity@Daily_CyberSecDisclosure

Wordfence’s AI system uncovered a critical, 9.8‑rated remote code execution vulnerability chain in the Avada WordPress theme, but no exploitation evidence or mitigation details have been released yet.