An AI Agent Chained Six Avada Bugs Into Zero-Click RCE in Two Hours.
An autonomous research system found and reproduced a six-step, unauthenticated remote-code-execution chain in the Avada WordPress theme in about two hours. The exploit is not public, but the patch is, and the finding changes both WordPress urgency and assumptions about AI-assisted vulnerability research.
CVE-2026-18431 affects Avada through version 7.16 when Fusion Builder through version 3.16 is installed and active. Successful exploitation also requires certain administrator-authored content to be present. When those conditions align, an anonymous request can be chained through six weaknesses into an arbitrary PHP file write and code execution in the security context of the web server.
ThemeFusion fixed the issue in Avada 7.16.1 and Fusion Builder 3.16.1 on 25 August 2026. Both components need to be updated together.
Six weaknesses, one zero-click route
The Wordfence analysis intentionally withholds the detailed exploit path, but it describes the chain at a high level:
- A public request accepts attacker-controlled input.
- The input reaches internal behaviour that was not intended for anonymous users.
- A privileged component can be called outside its expected context.
- Request data influences trusted state for the duration of the request.
- An administrative maintenance operation lacks sufficient authorisation.
- File-handling controls fail to constrain what can be written or where.
No individual link was enough to produce remote code execution. In the correct order, however, they allowed an unauthenticated attacker to place and execute an arbitrary PHP file. There is no login requirement and no victim click.
The AI finding is part of the security story
Wordfence says its private Argus framework found the complete chain unattended in about two hours, reproduced it and generated a working end-to-end proof of concept. The company presents Argus as a depth-oriented system designed to keep a long, dependent path in view rather than stop after identifying a single weakness.
This is consequential because multi-step chains have traditionally consumed substantial expert time. The result does not prove that every autonomous agent can discover similar vulnerabilities, and Wordfence is not publishing Argus or its underlying engineering. It does show that a well-designed agentic workflow can compress part of the research cycle from weeks or months into hours on a real, high-reach product.
The same compression affects both sides. Defensive researchers can identify and disclose complex chains faster. Attackers can use similar techniques to examine widely deployed software after a patch, advisory or code change narrows the search space.
PoC availability is private, not public
Wordfence created a working exploit in its test environment, but it has not released the proof of concept or the technical details needed to reproduce the chain. BlackTree found no credible public exploit and no confirmation of malicious exploitation at the time of writing.
Those distinctions matter. The vulnerability is reproducible and critical, but defenders should not describe the chain as actively exploited without new evidence. A private proof of concept lowers uncertainty about impact; a public exploit would lower the attacker effort required to reproduce it; confirmed attacks would change the incident-response posture again.
Affected and fixed versions
| Component | Affected | Fixed |
|---|---|---|
| Avada theme | 7.16 and earlier | 7.16.1 |
| Fusion Builder | 3.16 and earlier | 3.16.1 |
Successful exploitation requires both vulnerable components to be active and certain administrator-authored content to exist. That prerequisite should inform exposure analysis, but it should not delay patching. Determining whether every site contains the necessary content can take longer than updating the theme and bundled builder.
Firewall coverage and its limits
Wordfence Premium, Care and Response customers received a firewall rule on 30 July, the day the company confirmed the vulnerability. Free users are scheduled to receive the same rule on 29 August.
A firewall rule is a compensating control for known exploitation techniques. It is not a substitute for updating both Avada and Fusion Builder, and it does not prove that a site was not reached before the rule was deployed. ThemeFusion’s patch addresses all six weaknesses in the demonstrated chain.
What administrators should do
- Update both components. Install Avada 7.16.1 and Fusion Builder 3.16.1 or later.
- Verify the running versions. Check production, staging, archived and client-managed sites rather than relying on a central inventory alone.
- Review for file creation and PHP execution. Look for unexpected PHP files, modified theme or upload directories, unusual web-server child processes, new administrators and unfamiliar outbound connections.
- Keep the WAF rule enabled. Treat it as defence in depth while the update is deployed and verified.
- Reduce unused attack surface. Remove inactive themes, builders and bundled components that are no longer required.
The larger lesson
The Avada flaw is not one spectacular coding mistake. It is a sequence of modest trust and validation failures that becomes critical only when analysed end to end. That is precisely the kind of problem defenders often miss when code review, ownership and patching are divided by component.
Argus did not invent the weaknesses. It collapsed the time needed to connect them.
Sources and publication details
- Wordfence: Argus Finds Complex 6 Step Critical RCE in Avada, published 25 August 2026. The source provides a date but no publication time.
- ThemeFusion: Avada 7.16.1 Security Update, published and last updated 25 August 2026. No publication time was provided.