SecurityBleepingComputerabout 2 hours ago
Critical Avada WordPress theme flaw enables zero-click RCE
1 min read
A critical vulnerability chain in the Avada WordPress theme, tracked as CVE-2026-18431 with a 9.8 severity score, lets unauthenticated attackers execute arbitrary PHP code. The six-step zero-click attack affects Avada up to 7.16 and Fusion Builder up to 3.16. ThemeFusion released fixes in Avada 7.16.1 and Fusion Builder 3.16.1.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
