A critical six-step vulnerability chain in the popular Avada WordPress theme and its required Fusion Builder plugin could allow unauthenticated attackers to execute arbitrary PHP code and fully compromise vulnerable websites. Collectively tracked as CVE-2026-18431 with a CVSS score of 9.8/10, the zero-click attack combines authorization, input-validation, trust-boundary, and file-handling weaknesses that must be exploited in a specific sequence to achieve remote code execution (RCE). Successful exploitation could enable attackers to deploy malware, access website databases, create rogue administrator accounts, redirect visitors to malicious sites, and perform other unauthorized actions. The vulnerability affects Avada versions through 7.16 and Fusion Builder versions through 3.16, and because Fusion Builder is a required component installed alongside Avada, Wordfence warned that virtually any site running an outdated Avada installation could be vulnerable. The risk is significant given Avada’s widespread adoption, with more than one million sales. Wordfence researchers discovered and reproduced the vulnerability chain on July 30, 2026, using their Argus agentic security framework, which also generated proof-of-concept exploit code in roughly two (2) hours. The flaws were disclosed to ThemeFusion on August 5, and the vendor subsequently released fixes in Avada 7.16.1 and Fusion Builder 3.16.1, making prompt updates critical for administrators running affected versions.