Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4 ยท updates https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346 The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far. en Fri, 30 Oct 2026 00:00:00 GMT Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution. https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346 https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-30-c36cff57 Fri, 30 Oct 2026 00:00:00 GMT high <p><a href="https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311">Source</a></p> Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4: Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence. https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346 https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346#2026-10-27-5d35bc33 Tue, 27 Oct 2026 00:00:00 GMT high <p><a href="https://avada.com/blog/version-7-16-4-security-update/">Source</a></p>