The CVE record for a CVSS 9.8 unauthenticated remote code execution flaw in the Avada theme conditions exploitation on site content an administrator has to have created; the researchers who found it told reporters that any site with the theme installed is exploitable.
What happened
CVE-2026-18431 entered the National Vulnerability Database at 7:16 a.m. UTC on August 26, 2026, three days ago, carrying a CVSS 3.1 base score of 9.8 assigned by Wordfence, which is the CNA for this record. The record was revised once, on August 27, 2026. ThemeFusion shipped the fixes on August 26, 2026: Avada 7.16.1 and Fusion Builder 3.16.1. According to BleepingComputer, ThemeFusion acknowledged the report on August 10, 2026.
The flaw itself is an arbitrary file write that becomes remote code execution. The record’s description, which Wordfence authored and NVD republishes, reads in full:
“The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.”
Read the last sentence again, because it is the one doing the work. The advisory states two preconditions. Both components active is the easy one — Fusion Builder ships as a required companion to the Avada theme, so in practice that condition is satisfied nearly everywhere the theme runs. The second condition is not easy at all: certain administrator-authored content must already exist on the site. The record does not say what that content is.
Coverage of the flaw says something different. BleepingComputer, reporting on August 26, 2026, quotes the position that “Any site that has the Avada theme installed is going to be exploitable,” reasoning from the fact that Fusion Builder installs alongside the theme. That sentence accounts for the first precondition and passes over the second entirely. The advisory says exploitation requires particular content to be present. The public characterization says installation is sufficient. Those cannot both be true, and the difference is not academic: it is the difference between “every Avada site is a live target” and “an unknown subset of Avada sites is a live target, and nobody outside Wordfence currently knows which.”
One more detail from the record: NVD lists CVE-2026-18431 with a vulnerability status of Deferred. That is NVD’s marker for records it does not plan to enrich further with its own analysis — no NVD-assigned CVSS vector, no independently built list of affected configurations. On a three-day-old unauthenticated remote code execution flaw scored 9.8, it means the Wordfence description quoted above is not merely the first word on scope. For the foreseeable future it is the only word in the authoritative record.
The flaw is not in the CISA Known Exploited Vulnerabilities catalog. The NVD record carries no cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, or cisaRequiredAction fields, so there is no federal remediation deadline attached to it. No vendor or research firm has reported exploitation in the wild.
Why it matters
Avada is not a niche theme. ThemeFusion advertises more than a million sales, and the theme has been a fixture of the commercial WordPress market for over a decade. A precondition sentence in a CVE description is therefore not a footnote — it is the input to a triage decision being made this weekend by people who run hundreds or thousands of client sites and have to decide what to do first.
Those two readings produce opposite work plans. If installation is sufficient, the correct move is to treat every Avada site as compromised-until-proven-otherwise and patch on an emergency footing tonight. If particular administrator-authored content is required, the correct move is still to patch, but the panic is misplaced and the scarce hours are better spent on hunting: figuring out which sites carry the triggering content and checking those for files that should not exist. An operator who picks the wrong reading either burns a weekend on sites that were never reachable, or skips a hunt on the ones that were.
What makes this worth writing up rather than shrugging at is that the ambiguity is unnecessary. Wordfence knows what the triggering content is — it wrote the sentence. Withholding the specifics is a defensible choice while patch adoption is low; publishing an exact exploitation recipe for a 9.8 on a million-install theme days after the fix ships would be reckless, and there is a real argument for vagueness here. But vagueness in the advisory and confidence in the press quote are a bad combination. If the precondition is real and narrow, the public statement overstates the blast radius and will burn other people’s time. If the precondition is real but so commonly satisfied as to be no barrier, the advisory understates the risk and will cause some operators to deprioritize. Either way, one of the two statements is misleading somebody, and the party best positioned to reconcile them is the party that produced both.
The Deferred status compounds it. Under normal enrichment, NVD analysts build their own affected-configuration list, which frequently surfaces exactly this kind of scope question — the analyst has to decide what to encode, and encoding forces precision. A deferred record gets none of that. The CNA’s prose stands unchallenged, ambiguity and all, and every downstream scanner, dependency checker, and managed-service dashboard inherits it verbatim. This is a structural consequence of how NVD has been triaging its backlog, and it is going to keep producing records where the only description of scope is the one the finder chose to write.
There is also a disclosure-provenance question worth flagging. BleepingComputer reports that Wordfence found this flaw with an internal AI system it calls the Argus framework. If accurate, that is notable in itself — an AI-discovered chain of authorization and input-validation weaknesses spanning two components, at CVSS 9.8, on a million-install theme. It also raises a question this page cannot answer: whether an automatically derived precondition statement is as reliable as one written by a human who reproduced the exploit end to end. We flag it as a question, not a finding.
What to do
- Update Avada to 7.16.1 and Fusion Builder to 3.16.1. Both. The chain crosses the two components, and patching one is not a fix. Do this regardless of which reading of the preconditions you believe.
- Do not wait for clarification on the precondition to patch. The disagreement affects hunting priority, not whether to update.
- Hunt on the assumption that the flaw was reachable. Look for PHP files written into upload and theme directories since August 10, 2026, the date the vendor is reported to have been notified — not since August 26. Compare file modification times against your deployment history.
- Check for unexpected administrator accounts and for scheduled tasks or must-use plugins added in the same window.
- If you manage sites at scale, inventory by both components rather than by the theme alone, and record the Fusion Builder version. Version pairing is what determines exposure in the record as written.
- There is no federal deadline here. This is not a KEV entry, and nothing obliges a federal agency to act on a schedule. Prioritize it on severity and install base.
Sourcing note
The CVE description, CVSS score and source, publication and modification timestamps, and vulnerability status are quoted from the NVD API record for CVE-2026-18431, retrieved August 29, 2026: published 2026-08-26T07:16:45.500, last modified 2026-08-27T17:17:29.533, vulnStatus of Deferred, CVSS 3.1 base 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, source [email protected]. The identical description text appears on WPScan’s entry for the same CVE. The record contains no CISA KEV fields; cisa.gov returns 403 to automated fetching, so KEV status was checked through NVD’s republication of CISA’s own fields rather than against the catalog page directly.
We could not retrieve Wordfence’s own advisory page, which returned empty content on repeated attempts, so the description above is sourced through NVD and WPScan rather than from the publisher directly. The quoted characterization that “Any site that has the Avada theme installed is going to be exploitable,” the report that ThemeFusion acknowledged the issue on August 10, 2026, the more-than-one-million sales figure, and the attribution of discovery to an internal AI framework called Argus all come from BleepingComputer’s August 26, 2026 report. Those are secondary and we have not confirmed them against Wordfence or ThemeFusion. We did not reach ThemeFusion for comment and found no vendor statement addressing the precondition question.
Unresolved: what the “certain administrator-authored content” consists of, what fraction of Avada installations carry it, whether Wordfence considers the press characterization or the advisory text the accurate one, and whether NVD will lift the Deferred status and enrich the record.