Security
A critical flaw in the best-selling Avada theme lets an attacker take over a WordPress site with no login and no click. The fix has been out for weeks. Many sites still have not applied it.
Avada is the best-selling WordPress theme there is, with more than a million sales. In August, researchers disclosed a flaw in it that lets anyone on the internet take over a site running it - no account, no password, no one clicking a link. It is tracked as CVE-2026-18431 and rated 9.8 out of 10.
The fix was released on 26 August, as BleepingComputer reported at the time. Six weeks on, that should be the end of the story. For a lot of sites it is not, for a reason that has to do with how premium themes are updated - and it is worth ten minutes to make sure yours is not one of them.
Affected: Avada up to and including 7.16, and Fusion Builder (also called Avada Builder) up to and including 3.16. Fusion Builder is required by Avada, so every site running the theme has it. As Wordfence put it: "Any site that has the Avada theme installed is going to be exploitable" until it is updated.
Most WordPress vulnerabilities come with a catch that limits who can use them: the attacker needs an account, or needs an administrator to click something, or the flaw only exposes a little data. This one has none of those.
No login and no click. An attacker sends specially crafted requests to the site. Nobody on your side has to do anything for it to work - that is what "zero-click" means.
Full control of the site. The end result is remote code execution: the attacker can run their own PHP code on your server. That means they can add admin accounts, plant hidden backdoors, inject spam or malware into your pages, redirect your visitors, or read your database, including customer details and form submissions.
It is a chain, not a single bug. The attack links six separate weaknesses. One step gets attacker-controlled input into a public request, others carry it into functionality and admin operations that should have been off-limits, and the last one gets around the restrictions on what files can be written. None of the six might look critical on its own. Chained together, they hand over the site.
There is one more detail worth noticing. Wordfence found the chain using an automated, AI-driven research system that also wrote working proof-of-concept exploit code - in about two hours. Defenders are not the only ones with tools like that. The time it takes to go from "patch published" to "working attack" keeps shrinking, which we saw first-hand when a WordPress core flaw was exploited within hours of its fix last month.
Six weeks is plenty of time to apply an update. The reason it often has not happened is structural.
Premium themes do not update like free ones. Themes from the WordPress.org directory update through the dashboard, and can update automatically. Avada is sold through ThemeForest, and updates normally arrive only when the theme is registered with a valid purchase code. A site built by an agency or freelancer is often never registered in the client's name, so the update notice simply never appears.
The theme and the builder are separate updates. Avada and Fusion Builder have to be updated together. It is easy to update one and assume the job is done.
Fear of breaking the site. Avada sites are usually built visually with the page builder, and owners have learned that big theme updates can shift layouts. So updates get postponed, sometimes for years.
Nobody is watching. A site that was launched and handed over, with no maintenance arrangement, has no one whose job it is to notice a security disclosure about its theme.
If any of those sound familiar, assume your site has not been updated until you have checked.
If both the theme and the builder are on the fixed versions or newer, you are patched. If either is older, update today - and read the section on exposure below, because you have been vulnerable since the flaw went public.
1. Take a full backup first - files and database - and make sure it is stored off the server.
2. Use a staging copy if you have one. Update there first, check the key pages and forms, then repeat on the live site. If you do not have staging, do not let that delay a critical fix: update the live site and check it straight afterwards.
3. Register the theme if needed. Use the purchase code from the ThemeForest account the theme was bought on. If your developer bought it, ask them for the code or for the theme to be transferred to you - you should own the licence for your own site anyway.
4. Update the theme and the bundled plugins together, then confirm the version numbers rather than assuming it worked.
5. Clear any caches - plugin, server and CDN - and check the site in a private browser window.
Updating closes the hole. It does not remove anyone who came through it while it was open. If your site was on a vulnerable version after 26 August, take a look for signs of compromise:
If you find anything, do not just delete it and move on. Attackers usually leave more than one way back in. Restore from a clean backup taken before the site was compromised, update everything, then change every password and key: WordPress admins, hosting, database and FTP. If you are not confident doing that, get help - a half-cleaned site gets reinfected.
Avada is a capable theme, and this is not an argument against it. ThemeFusion fixed the flaw in a reasonable time after it was reported. The weak point was never the vendor. It is the gap between a fix existing and a fix reaching your site.
That gap is widest for premium themes and plugins, because they sit outside WordPress's automatic update system and depend on a licence someone has to keep registered. When we build on a commercial theme or plugin, the licence is registered to the client from day one, and updates are part of ongoing website maintenance and support, not something left for the client to discover.
If you are running Avada and are not sure which version you are on, who holds the licence, or whether the site was touched while it was exposed, get in touch. We will check it with you, and if it needs fixing, our WordPress team can take care of it.
Need a hand with this? Orange Orbits builds and markets websites for businesses across the United States. Book a free 45-minute scoping call and we will give you a straight answer about your specific situation.
Keep reading
An update stops new attacks. It does nothing about files an attacker already wrote to your server. If your site was patched late, here is how to find out whether someone got in first.
Read articleThe third WordPress security release in a month fixes seven vulnerabilities, from stored XSS to SQL injection. Here is what each one means, and which sites should care most.
Read articleExploitation attempts against a WordPress core flaw started within hours of the fix shipping. The patch window is now measured in hours, and that changes how sites should be maintained.
Read articleBook a 45-minute call. We will ask about your goals, your constraints and your timeline, then send a written recommendation with real numbers. If we are not the right fit, we will tell you who is.
