CVE-2026-115346: RCE in Avada WordPress

RCE via file upload in Avada WordPress (up to 7.16.2). Unauthenticated attack, CVSS 8.1. Urgent patch.

CVE-2026-115346 affects Avada, one of the most widely used WordPress page builders, through an arbitrary file upload flaw in the convert_palette_images_to_truecolor() function. An unauthenticated attacker can upload files without type validation, including executable PHP scripts, and trigger their execution on the server. This enables a full remote code execution (RCE) attack.

With a CVSS score of 8.1, this flaw is classified as High severity: a network attack requiring no credentials with high impact on confidentiality, integrity, and availability. The vulnerability was published on NVD on October 30, 2026—just two days ago. Social media signals are limited (1 X post with 3 interactions), but coherent: the CVE and CVSS are cited correctly. No public exploits on repositories are known at present.

Website owners using the Avada theme on WordPress must immediately check the installed version. If it is 7.16.2 or lower, updating is critical and should happen as soon as possible. In parallel, review access logs and file system to detect unusual uploads, suspicious script executions, or unauthorized PHP file creation in upload directories. Monitor official Avada channels for patch availability.

At a glance

What: Arbitrary file upload in Avada WordPress theme via convert_palette_images_to_truecolor() function, with insufficient file type validation. Unauthenticated attacker can upload and execute PHP files, achieving remote code execution (RCE).
Severity: CVSS 8.1 (High). Network attack vector, no credentials required, high impact on confidentiality, integrity, and availability.
Affected versions: Avada theme for WordPress, versions up to 7.16.2 (inclusive).
Fix: Patched version not reported in provided NVD data. Check official Avada release notes for the secure version.
Status: Vulnerability published on NVD on 2026-10-30. No known public exploits on GitHub repositories. Limited social media signals (1 X post), coherent with CVE details.
Action: Check Avada version on all corporate WordPress sites. If ≤ 7.16.2, update immediately. Review access logs and file system for unusual uploads, unauthorized PHP files, suspicious access patterns.

Sources: NVD, CVE-2026-115346

← All articles