Critical Avada WordPress Theme Flaw (CVE-2026-18431) Enables Zero-Click RCE

Key facts for Avada Fusion Builder RCE

Detection coverage for Avada Fusion Builder RCE

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2157 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Avada Fusion Patcher Exploitation Attempt — Webshell Payload Markers in admin-ajax.php/REST Requests (CVE-2026-18431)

Detects likely exploitation attempts against the Avada/Fusion Builder Fusion Patcher missing-authorization chain (CVE-2026-18431): requests to wp-admin/admin-ajax.php or the WordPress REST API (/wp-json/) whose URI or body contains PHP webshell/code-execution payload markers (eval(, base64_decode(, system(, passthru(, shell_exec(, assert(, preg_replace(), consistent with the disclosed six-step exploitation/file-write chain. No public PoC exists; this targets the class of request Wordfence and SecurityArsenal flag as the likely trigger surface.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1140, T1027
• Data sources: web_access_logs (apache/nginx), wordpress_application_logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=apache:access OR sourcetype=nginx:access)
| eval decoded_uri=urldecode(uri_query)
| where (like(uri_path, "%wp-admin/admin-ajax.php%") OR like(uri_path, "%wp-json%"))
    AND match(decoded_uri . " " . _raw, "(?i)(eval\(|base64_decode\(|system\(|passthru\(|shell_exec\(|assert\(|preg_replace\()")
| eval fusion_patcher_ref=if(match(lower(_raw), "fusion.?patcher|fusionbuilder|avada"), 1, 0)
| stats count as request_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as targeted_paths, values(http_method) as methods, values(status) as http_status by src_ip, host
| where request_count >= 1
| eval severity=if(fusion_patcher_ref=1, "critical", "high")
| sort -request_count

Microsoft KQL

let WebshellMarkers = dynamic(["eval(", "base64_decode(", "system(", "passthru(", "shell_exec(", "assert(", "preg_replace("]);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has_any ("wp-admin/admin-ajax.php", "wp-json")
| where csUriQuery has_any (WebshellMarkers)
| extend FusionPatcherRef = csUriQuery has_any ("fusion", "avada", "patcher")
| project TimeGenerated, cIP, sIP, csUriStem, csUriQuery, csMethod, scStatus, FusionPatcherRef
| summarize RequestCount = count(), TargetedPaths = make_set(csUriStem), Methods = make_set(csMethod), AnyFusionRef = max(FusionPatcherRef) by cIP, sIP, bin(TimeGenerated, 1h)
| where RequestCount >= 1
| extend Severity = iff(AnyFusionRef == 1, "Critical", "High")
| order by RequestCount desc

Sigma

title: Avada Fusion Patcher Exploitation Attempt (CVE-2026-18431)
id: 3a7c1e8e-6b1a-4f9d-9c2e-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated requests to WordPress admin-ajax.php or the REST API containing encoded PHP webshell payload markers, consistent with exploitation of the Avada/Fusion Builder Fusion Patcher missing-authorization chain (CVE-2026-18431).
references:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18431
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1140
    - attack.t1027
    - cve.2026.18431
logsource:
    category: webserver
    product: nginx
detection:
    selection_path:
        cs-uri-stem|contains:
            - 'wp-admin/admin-ajax.php'
            - 'wp-json'
    selection_marker:
        cs-uri-query|contains:
            - 'eval('
            - 'base64_decode('
            - 'system('
            - 'passthru('
            - 'shell_exec('
            - 'assert('
            - 'preg_replace('
    condition: selection_path and selection_marker
falsepositives:
    - Legitimate plugin AJAX handlers that pass base64-encoded payloads (e.g. media/autosave)
    - Authorized security scanning or penetration testing
level: high

Known false positives:

• Legitimate plugin/theme AJAX handlers that legitimately pass base64-encoded data (e.g. media uploads, page-builder autosave)
• Authorized vulnerability scanning or penetration testing traffic

Tuning notes: Allowlist known legitimate AJAX action= values that pass base64 payloads; require co-occurrence of a Fusion Patcher/Avada URI or body reference with a webshell marker before escalating to critical; scope to internet-facing WordPress hosts only.

• 🔒 [indicator] Fusion Patcher Exploitation Attempt — Webshell Payload Markers in admin-ajax.php/REST Requests (CVE-2026-18431) · unlock with TL Creds
• 🔒 [indicator]/Fusion Patcher Post-Exploitation — Webshell File Write, MU-Plugin Backdoor & Unauthorized WordPress Admin Creation · unlock with TL Creds
• 🔒 Post-Compromise C2 — Web Server Worker Process Spawning Shell & Beaconing to External Host ([indicator]/Fusion Patcher RCE) · unlock with TL Creds
• 🔒 [indicator] Fusion Patcher Exploitation Attempt — Webshell Payload Markers in admin-ajax.php/REST Requests (CVE-2026-18431) · unlock with TL Creds
• 🔒 [indicator]/Fusion Patcher Post-Exploitation — Webshell File Write, MU-Plugin Backdoor & Unauthorized WordPress Admin Creation · unlock with TL Creds
• 🔒 Post-Compromise C2 — Web Server Worker Process Spawning Shell & Beaconing to External Host ([indicator]/Fusion Patcher RCE) · unlock with TL Creds
• 🔒 [indicator]/Fusion Patcher Post-Exploitation — Webshell File Write, MU-Plugin Backdoor & Unauthorized WordPress Admin Creation · unlock with TL Creds
• 🔒 Post-Compromise C2 — Web Server Worker Process Spawning Shell & Beaconing to External Host ([indicator]/Fusion Patcher RCE) · unlock with TL Creds

Indicators of compromise for Avada Fusion Builder RCE

As of 2026-08-29, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-2157.

How Avada Fusion Builder RCE works

Wordfence's Argus AI research agent found, reproduced, and privately proved the chain in about two hours; ThemeFusion shipped patched 7.16.1/3.16.1 builds on 2026-08-25 with no public PoC and no reported in-the-wild exploitation.

CVE-2026-18431 (CWE-862, Missing Authorization) affects the Avada WordPress theme up to and including version 7.16 together with its bundled Fusion Builder page-builder plugin up to and including version 3.16, when both are installed and active. The root cause sits in the Fusion Patcher, Avada's built-in mechanism for fetching update instructions from outside the site and applying them to local files and options -- functionally a self-update channel, and correspondingly powerful when abused. Wordfence describes an unauthenticated six-step exploit chain: (1) a public-facing request exposes attacker-controlled input; (2) that input reaches internal behavior not intended for anonymous users; (3) a privileged component (the Fusion Patcher) is invoked outside its intended context; (4) the request data is used to influence trusted server-side state for the duration of the request; (5) an administrative/maintenance operation is reached with insufficient authorization checks; and (6) file-handling controls fail to adequately constrain the location and content of files the Patcher writes, allowing an arbitrary PHP file to be created on disk. Because every link in the chain is required, breaking any single one blocks the demonstrated path -- but no individual step looks obviously malicious in isolation, which is why Wordfence characterizes this class of flaw as evading naive signature-based scanning and single-request WAF rules.

Independent detection-engineering analysis (SecurityArsenal) mapping the disclosed step pattern onto known WordPress exploitation primitives assesses the likely underlying mechanics as: an unauthenticated AJAX (`admin-ajax.php`) or REST (`/wp-json/`) request that leaks state, writes attacker-controlled data into a transient/option, or bypasses a nonce check (steps 1-2); a second request that weaponizes that state -- e.g. registering a malicious shortcode, injecting a serialized PHP object (PHP object injection), or setting an arbitrary option (steps 3-4); and a final trigger that coerces the application into including or evaluating attacker-controlled PHP via template injection, an `include`/`require` on a now-writable path, or a file write into `wp-content/uploads/` (steps 5-6). This is a plausible reconstruction consistent with the publicly confirmed chain shape, not Wordfence's withheld technical detail.

The vulnerability was discovered by Argus, a new single-target agentic AI research tool Wordfence built specifically to find long, multi-step exploit chains that would take a skilled human researcher weeks or months to connect (if they connected all six links at all). Argus found and reproduced the chain, and wrote a working proof-of-concept, unattended in approximately two hours. It is the second such AI research agent Wordfence has publicly disclosed in 2026, alongside PRISM (launched April 2026), which has logged over 300 vulnerabilities and caught a WordPress.org-hosted plugin supply-chain backdoor in under two hours in July 2026. Wordfence has deliberately withheld the technical specifics of how Argus works and has not published exploit code, arguing the same agentic techniques that help defenders find and fix flaws quickly would help attackers exploit them just as quickly.

Disclosure timeline: the CVE was reserved and Argus found/reproduced the chain on 2026-07-30, the same day Wordfence deployed a firewall rule to Premium/Care/Response customers; ThemeFusion was notified on 2026-08-05 and acknowledged the report on 2026-08-10; patched Avada 7.16.1 and Fusion Builder 3.16.1 shipped on 2026-08-25 (Avada's changelog and blog post credit Wordfence by name, though the vendor's public post withholds function-level technical detail and points users to the full changelog/help docs instead); the free-tier Wordfence firewall rule is scheduled for 2026-08-29 under Wordfence's standard 30-day premium-to-free delay. CVE-2026-18431 was published in NVD on 2026-08-26 with CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). As of publication there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. Given the >1 million-site install base of Avada (narrowed in practice to sites running both Avada and Fusion Builder active together), the critical unauthenticated pre-auth nature of the flaw, and the demonstrated speed at which agentic tooling can now both find and (in principle) weaponize such chains, defenders are urged to patch immediately rather than wait for evidence of active exploitation.

Because full technical detail is withheld, defensive guidance published by third-party detection engineers focuses on the likely post-exploitation artifacts and follow-on behavior of an arbitrary-PHP-write primitive rather than the exact request chain: monitoring POST traffic to `admin-ajax.php` and the WordPress REST API for webshell payload markers (including legacy `preg_replace()` `/e`-modifier code-execution patterns); watching for new `.php`/`.phtml`/`.phar`/`.php7`/`.php8` files written into `wp-content/uploads/`; auditing `wp-content/mu-plugins/` for planted must-use-plugin backdoors (a common WordPress persistence mechanism once arbitrary file write is achieved); checking the `wp_users` table for unauthorized new administrator accounts; checking `wp-config.php` for signs of database-credential harvesting/exposure; alerting on PHP-FPM/Apache/Nginx worker processes spawning shell child processes; and hunting for outbound connections from web-server worker processes to non-RFC1918 (external) addresses as a beaconing/C2 indicator. Site owners are advised to update both Avada and Fusion Builder immediately, verify version numbers (`wp-content/themes/Avada/style.css`) across every affected site, and treat the Fusion Patcher -- and self-update/patch-delivery subsystems generally -- as sensitive attack surface going forward, since a vulnerability in a self-patching mechanism grants an attacker whatever that mechanism can do.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Defense Evasion

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1552.001 Credentials In Files

Resource Development

T1584.004 Compromise Infrastructure

Remediation for Avada Fusion Builder RCE

Patches

• Avada 7.16.1 (released 2026-08-25) — fixes the Fusion Patcher remote code execution vulnerability
• Fusion Builder 3.16.1 (released 2026-08-25)

Immediate actions

• Update the Avada theme to 7.16.1 or later
• Update the Fusion Builder plugin to 3.16.1 or later
• Verify the deployed version in wp-content/themes/Avada/style.css and the Fusion Builder plugin listing after updating, across every WordPress site running Avada

Workarounds

• Deactivate Fusion Builder / Avada Builder if immediate patching is not possible
• Wordfence Premium/Care/Response firewall rule available since 2026-07-30; free-tier Wordfence firewall rule scheduled for 2026-08-29

Longer-term hardening

• Block direct PHP execution inside wp-content/uploads/ via .htaccess/Nginx rules to reduce webshell impact if a similar file-write flaw recurs
• Deny PHP execution in wp-includes/ where feasible
• Monitor POST traffic to admin-ajax.php and the WordPress REST API for webshell payload markers (eval(, base64_decode(, system(, passthru(, shell_exec(, assert(, preg_replace()
• Alert on PHP-FPM/Apache/Nginx worker processes spawning shell child processes (/bin/sh, /bin/bash, curl, wget, nc, python)
• Hunt for outbound connections from web-server worker processes to non-RFC1918 addresses as a C2-beaconing indicator
• Audit wp-content/mu-plugins/ for planted must-use-plugin backdoors
• Audit the wp_users table for unauthorized administrator accounts created after the disclosure window
• Check wp-config.php for signs of database-credential exposure/harvesting
• Treat self-update/patch-delivery subsystems (like Fusion Patcher) as sensitive attack surface and reduce patch SLA for critical CMS RCEs given AI-accelerated vulnerability research timelines

Affected and fixed versions

• ThemeFusion — Avada (WordPress theme)
  Vulnerable versions: <= 7.16
  Fixed in: 7.16.1
• ThemeFusion — Fusion Builder (WordPress plugin, bundled with Avada)
  Vulnerable versions: <= 3.16
  Fixed in: 3.16.1

Timeline of Avada Fusion Builder RCE

Last updated 2026-08-29 · revalidated 1× · latest source

• 2026-07-30 locked-ioc-7 deploys a firewall rule covering the vulnerability to Premium, Care, and Response customers.
• 2026-07-30 locked-ioc-7's locked-ioc-13 AI research agent finds and reproduces the six-step exploit chain and writes a working internal proof-of-concept, unattended, in approximately two hours.
• 2026-07-30 CVE-2026-18431 is reserved (per NVD/CVE record metadata), coinciding with locked-ioc-13's discovery of the chain.
• 2026-08-05 locked-ioc-7 notifies locked-ioc-5 of the vulnerability.
• 2026-08-10 locked-ioc-5 acknowledges receipt of the vulnerability report.
• 2026-08-25 locked-ioc-5 releases locked-ioc-15 7.16.1 and locked-ioc-3 3.16.1, fixing the Fusion Patcher remote code execution vulnerability and crediting locked-ioc-7 in the changelog and blog post.
• 2026-08-26 BleepingComputer and other outlets publish coverage of the vulnerability; locked-ioc-7 continues to withhold full technical/exploit detail.
• 2026-08-26 CVE-2026-18431 is published in the NVD with CVSS 3.1 score 9.8 (Critical).
• 2026-08-27 NVD's CVE-2026-18431 record last-modified timestamp updates.
• 2026-08-28 WPScan's vulnerability database entry last-updated timestamp updates; CVE-2026-18431 is confirmed still absent from the CISA Known Exploited Vulnerabilities catalog as of this date.
• 2026-08-29 locked-ioc-7's free-tier firewall rule is scheduled to release, following the standard 30-day premium-to-free protection delay.

Update history

• 2026-08-29 — CVE-2026-18431: Unauthenticated Zero-Click RCE in locked-ioc-15 WordPress Theme + locked-ioc-3 via Arbitrary File Write: What changed No field-level change: severity (CRITICAL), CVSS (9.8), exploitability (THEORETICAL), and attribution (Unattributed/Unknown, LOW confidence) all confirmed unchanged. The newer report's own status value ('ACTIVE') was NOT applie

Sources cited for Avada Fusion Builder RCE

• Avada (Fusion) Builder RCE advisory — Wordfence Threat Intelligence wordfence.com · Advisory · 2026-08-26
• CVE-2026-18431 Detail — NVD NVD (NIST) · Advisory · 2026-08-26
• Known Exploited Vulnerabilities Catalog (checked — CVE-2026-18431 not listed as of publication) CISA · Government advisory · 2026-08-26
• Version 7.16.1 Security Update — Avada Website Builder avada.com · Vendor report · 2026-08-25
• CVE-2026-18431: CWE-862 Missing Authorization in themefusion Avada (Fusion) Builder — Threat Radar radar.offseq.com · Research · 2026-08-26
• Wordfence's New AI Agent Chains Six Flaws Into a Critical Unauthenticated RCE in Popular Avada Theme therepository.email · Blog · 2026-08-26
• Critical 6-Step RCE in Avada WordPress Theme (1M+ Sites): Detection and Remediation Guide securityarsenal.com · Blog · 2026-08-26
• Avada 7.16.1 Fixes Fusion Patcher RCE: What to Do Now magicwp.io · Blog · 2026-08-26
• Critical Avada WordPress theme flaw enables zero-click RCE BleepingComputer · News · 2026-08-26
• Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales malware.news · News · 2026-08-26

Threats related to Avada Fusion Builder RCE

• Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP
• wp2shell RCE Chain in WordPress Core (CVE-2026-60137, CVE-2026-63030) — Emergency Patch Released
• WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)
• CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies
• Critical FreeRDP Clipboard Virtual Channel Heap Buffer Overflow (GHSA-cj9v-h4hq-29jr, CVSS 9.4)

Related coverage of this activity

• Avada Builder path traversal
• Beloved PBN database-resident webshell
• StopAndProtect WordPress malware
• Ghost CMS SQL injection
• Ollama VAPT LLMjacking pipeline