Critical Avada flaw enables zero-click RCE on WordPress sites CVE-2026-18431 is a six-step vulnerability chain affecting Avada up to 7.16 and Fusion Builder up to 3.16, allowing unauthenticated attackers to execute arbitrary PHP code. ThemeFusion patched the issue in 7.16.1/3.16.1, while Avada deployments remain broadly exposed because Fusion Builder is installed with the theme.

https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/