Description

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T07:16:45.500Z",
  "pubdate": "2026-08-26T07:16:45.500Z",
  "executiveSummary": "The Avada WordPress theme and Fusion Builder plugin are susceptible to an Arbitrary File Write vulnerability that allows unauthenticated remote attackers to upload and execute malicious files on the underlying server.\nThe vulnerability stems from a chain of authorization and input validation flaws spanning both the theme and the plugin components, resulting in a critical risk to site integrity and security.\nSuccessful exploitation leads to Remote Code Execution (RCE) and total site compromise, as attackers can inject arbitrary PHP code into the server environment.\nImpact includes unauthorized data access, server hijacking, and complete control over the WordPress installation.\nExploitation requires both Avada (up to 7.16) and Fusion Builder (up to 3.16) to be active, alongside the presence of specific administrator-authored content.",
  "technicalDetails": "The vulnerability is identified as an Arbitrary File Write flaw caused by improper authorization checks and insufficient input sanitization within the interaction between the Avada theme and the Fusion Builder plugin.\nThe root cause resides in the architecture of the component communication, which fails to enforce strict access control at the entry point of the affected modules. This weakness allows an unauthenticated actor to interact with system-level file-writing functions that should otherwise be restricted to high-privilege administrators.\nThe attack flow begins when an attacker sends a crafted request to the site. Due to the failure in authorization validation, the application processes the request as if it were authorized, bypassing standard security checks. The attacker leverages the input validation flaw to control the content and the target destination of the file write operation.\nBy manipulating the parameters sent to the vulnerable endpoints, an attacker can influence the application to create or overwrite files within the web-accessible directory. Because the system lacks sufficient filtering for the input payload, the attacker can inject malicious PHP code into these files.\nOnce the file is written to the server, the attacker can execute the payload by simply requesting the path of the newly created file via a browser or HTTP client. This transition from a file write to RCE provides the attacker with full control over the execution environment. The attacker can then deploy webshells, access database credentials stored in wp-config.php, or pivot into the underlying server infrastructure.\nAffected products include Avada theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16. The vulnerability is network-exposed and does not require the attacker to possess an existing account or administrative privileges, provided the specific conditions regarding the presence of administrator-authored content are met.\nPost-exploitation impact is catastrophic, as it facilitates full-system compromise, lateral movement within the hosting environment, and potential exfiltration of sensitive site data."
}