Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4
Avada Website Builder theme for WordPress & WooCommerce (ThemeFusion)
The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far.
Why this severity: CVSS 3.1 8.1 (Wordfence); unauthenticated, but needs a form with an upload field and high attack complexity; no exploitation reported yet
- Started
- Oct 27, 2026
Affected
- Avada theme up to and including 7.16.2 (sites using Avada Forms upload fields)
Fixed in
- Avada Classic 7.16.4
Timeline2
Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution.
Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence.
Advisories3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
