{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4 · updates",
  "home_page_url": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346",
  "feed_url": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/feed.json",
  "description": "The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the \"possible remote code execution vulnerability in Avada Forms upload fields\" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far.",
  "language": "en",
  "_pwn": {
    "slug": "avada-theme-form-upload-rce-cve-2026-115346",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/feed.xml",
    "llms": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/llms.txt",
    "json": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-30-c36cff57",
      "url": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-30-c36cff57",
      "title": "Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution.",
      "content_text": "Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution.\n\nSource: https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-27-5d35bc33",
      "url": "https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-27-5d35bc33",
      "title": "Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence.",
      "content_text": "Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence.\n\nSource: https://avada.com/blog/version-7-16-4-security-update/",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://avada.com/blog/version-7-16-4-security-update/",
      "tags": [
        "high"
      ]
    }
  ]
}