CVE-2026-18431: CWE-862 Missing Authorization in themefusion Avada (Fusion) Builder

The Avada theme for WordPress, combined with the Fusion Builder plugin, suffers from a chain of authorization and input validation weaknesses (CWE-862 Missing Authorization) that permit unauthenticated attackers to perform arbitrary file writes on the server. This vulnerability affects all versions of Avada up to 7.16 and Fusion Builder up to 3.16. The flaw enables attackers to create and execute arbitrary PHP files, resulting in remote code execution and full control over the affected site. Exploitation requires both components to be installed and active, and the presence of specific administrator-authored content.

An unauthenticated attacker can write arbitrary files to the server, leading to remote code execution and complete compromise of the WordPress site. This allows full control over the affected system, including potential data theft, site defacement, or further attacks on the hosting environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling either the Avada theme or the Fusion Builder plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.