-
A serious bug in the Avada WordPress theme lets hackers take over websites without any user action.
-
The flaw, tracked as CVE-2026-18431, scored 9.8 out of 10, making it a critical risk.
-
Avada has sold over one million copies, and updates are now available to fix the problem.
A dangerous security flaw has been found in Avada, one of the most popular WordPress themes on the market. According to a report, attackers can break into websites using this theme without needing a password or any click from a real user. The bug lets hackers run harmful code directly on the site.
How the Attack Works
The flaw carries the label CVE-2026-18431. It scored 9.8 out of 10 on the CVSS scale, which measures how dangerous a bug is. That score places it in the critical category, the highest level of risk.
The problem affects Avada versions up to 7.16. It also needs the Fusion Builder plugin, running version 3.16 or older, to work. ThemeFusion, the firm powering Avada, has now released fixes. Avada 7.16.1 as well as Fusion Builder 3.16.1 both close the hole.
Researchers at Wordfence explained that this is not one simple mistake. Instead, it is a chain of six separate weaknesses. Hackers must trigger them in the right order for the attack to succeed. Wordfence noted that the attack starts with a public request. From there, it moves into areas meant only for logged-in users. Finally, it lets attackers skip file safety checks and place harmful files on the server.
Once that happens, hackers gain the power to run any code they want. They could install malware, steal private data, change website content or send visitors to fake pages. In the worst case, they could even create new admin accounts, giving them full control.
Patchstack, another cybersecurity firm, also rated the bug at 9.8. Patchstack described the flaw as a way for attackers to upload files without logging in first. The firm warned that bugs like this often get used in mass attacks. Hackers can target thousands of sites at once using automatic tools.
Why so Many Websites are at Risk
Avada is not a small or unknown theme. It has sold more than one million copies. That means a huge number of websites could be exposed right now.
The scale of the threat is underscored by a separate dark web listing that exposed nearly 19,000 WordPress site admin credentials, including email addresses and plaintext passwords tied to specific login URLs. The dataset provides attackers with ready-to-use access to site backends, eliminating the need for cracking or brute-force attacks.
Some may assume the risk is smaller since Fusion Builder is also required for the attack. But Wordfence pointed out that this does not shrink the danger much. Fusion Builder comes bundled with Avada. So any site running Avada almost certainly runs the plugin too.
Interestingly, this flaw was not found by a person alone. Wordfence used a tool called Argus, its own AI system built for hunting security bugs. Argus managed to find and successfully test the entire six-step attack chain. It even built working proof code, and it did all this in about two hours.
The timeline shows how fast this moved. Argus first spotted the bug on July 30, 2026. Wordfence then shared full technical details with ThemeFusion on August 5. ThemeFusion confirmed the report on August 10. The company released the fix on August 26. Wordfence chose to hold back full exploit details for now. This gives site owners time to update before hackers can copy the attack.
What Website Owners Should Do Now
Security experts are urging anyone using Avada to act fast. Update to Avada 7.16.1 or newer right away. Also update Fusion Builder to version 3.16.1 or later. These two updates together close the security gap.
Patchstack has released a special rule for users of its own security platform. This can help block attacks even before a full manual update is done. Still, applying the official patch remains the safest long-term fix.
This case also shows a bigger shift happening in cybersecurity. AI tools are now capable of finding complex bugs that need several steps chained together. That kind of bug used to take skilled humans much longer to uncover. Wordfence’s use of Argus shows how AI can speed up the hunt for dangerous flaws hidden deep inside popular software.
At the same time, this speed cuts both ways. If defenders can use AI to find bugs faster, attackers may eventually try the same approach. That makes fast patching even more important going forward.
For now, the fix is simple and available. Website owners running Avada should not wait. Every day a site stays on an old version is another day it remains exposed to a serious, working attack method.
Stay updated. Check your Avada and Fusion Builder versions today. And don’t assume your site is safe just because nothing has happened yet.
