Avada WordPress Theme: Unauthenticated arbitrary file upload in Forms
Summary
The Avada theme for WordPress and WooCommerce up to and including 7.16.2 does not sufficiently validate file types in uploads processed by the convert_palette_images_to_truecolor() function. An unauthenticated remote attacker can upload potentially executable files, which may lead to remote code execution on the web server. The vendor fixed the issue in Avada 7.16.4 and describes it as a possible remote code execution in Avada Forms upload fields.
Affected
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce, versions 0 up to and including 7.16.2
- Fusion Builder version tied to this CVE: Unknown.
Fixed in
- Avada 7.16.4 or later (vendor advisory dated 27 Oct 2026; one changelog mirror lists 26 Oct 2026)
- Fusion Builder fixed version for this CVE: Unknown. Verify against the vendor changelog.
Workaround
- No vendor workaround known. The fix is the update.
- Until patched, restrict or disable Avada Forms upload fields if business needs allow (not vendor-documented).
Exploitation
- Not known to be exploited in the wild.
- No public exploit code or nuclei template indexed as of 30 Oct 2026.
- Not listed in CISA KEV at the time of the research.
- EPSS: 0.66 % (percentile 52).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all WordPress sites running Avada and record the theme and Fusion Builder versions.
- Update Avada to 7.16.4 or later and confirm the Fusion Builder version against the vendor changelog.
- Until updated, restrict upload-enabled forms where feasible.
- Check upload directories and recent form submissions for unexpected PHP or script files; treat any finding as an incident.
- Prioritise public-facing sites with upload-enabled forms and monitor the vendor advisory and CISA KEV.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Avada Version 7.16.4 Security Update avada.com
- Wordfence threat intelligence entry www.wordfence.com
- Avada on ThemeForest themeforest.net
- VulDB entry 429245 vuldb.com
- Vulners PT-2026-133700 vulners.com
- OffSeq Radar threat entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:46.
Original description (NVD)
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.