What the vulnerability does
01Description
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.
Explanation of Vulnerability in Simple Terms
02Summary
Avada (Fusion) Builder versions 3.16 and earlier lack proper authorization checks, allowing unauthenticated attackers to read, modify, or delete data on affected sites. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update to a version newer than 3.16 immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data without authentication.
Potential impact on your site
04Site Impact
Attackers can compromise site data, user information, and site integrity without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 26, 2026
CVE published
August 27, 2026
Record updated
