
AI Edge · 49m ago
Critical Avada WordPress flaw enables zero-click server takeover
Wordfence researchers at Defiant disclosed CVE-2026-18431, a critical nine-point-eight severity chain that lets unauthenticated attackers execute arbitrary PHP code on any server running vulnerable Avada themes up to 7.16 or Fusion Builder plugins up to 3.16.