# Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4 · pwn.watch > The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far. Page: https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346 · generated 2026-10-30T21:12:50.286Z ## Status - Severity: high · status: live · patch: patched - Product: Avada Website Builder theme for WordPress & WooCommerce (ThemeFusion) - Started: 2026-10-27 - CVEs: CVE-2026-115346 - Affected: Avada theme up to and including 7.16.2 (sites using Avada Forms upload fields) - Fixed in: Avada Classic 7.16.4 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/feed.xml - JSON Feed: https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346.json - This file: https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346/llms.txt ## Updates (newest first) - 2026-10-30: Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution. (https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311) - 2026-10-27: Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence. (https://avada.com/blog/version-7-16-4-security-update/) ## Fix brief # Security brief: Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4 Source: https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346 · status: live · severity: high · updated Oct 30, 2026, 18:02 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far. Severity detail: CVSS 3.1 8.1 (Wordfence); unauthenticated, but needs a form with an upload field and high attack complexity; no exploitation reported yet - Product: Avada Website Builder theme for WordPress & WooCommerce (ThemeFusion) - CVE / advisory ids: CVE-2026-115346 ## Affected versions - Avada theme up to and including 7.16.2 (sites using Avada Forms upload fields) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Avada Classic 7.16.4 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Update the Avada theme to 7.16.4 or later, following Avada's update instructions linked from its 7.16.4 security post (it is a premium theme, so updates come through Avada's own updater or a fresh download). Afterwards, check wp-content/uploads for unexpected .php or other executable files. Re-check Wordfence and news for exploitation reports. ## Latest updates - Oct 30, 2026: Wordfence publishes CVE-2026-115346 (CVSS 8.1 high): unauthenticated arbitrary file upload in Avada up to 7.16.2 via convert_palette_images_to_truecolor(), which can lead to remote code execution. - Oct 27, 2026: Avada releases Avada Classic 7.16.4, which fixes a possible remote code execution vulnerability in Avada Forms upload fields, crediting Wordfence. ## Advisories - [Version 7.16.4 Security Update](https://avada.com/blog/version-7-16-4-security-update/) (Avada (ThemeFusion)) - [Avada <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field](https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311) (Wordfence) - [CVE-2026-115346](https://www.cve.org/CVERecord?id=CVE-2026-115346) (CVE Program (Wordfence)) --- Machine-readable: https://pwn.watch/i/avada-theme-form-upload-rce-cve-2026-115346.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.