Description
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Published: 2026-10-30
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Avada theme contains a flaw in the convert_palette_images_to_truecolor() function that fails to validate the type of files uploaded through a form field. This allows an unauthenticated user to upload a file of any type, including executable code, which then runs with the privileges of the web server. The consequence is remote code execution, giving an attacker full control over the WordPress installation.

Affected Systems

The vulnerability exists in the ThemeFusion Avada theme for WordPress and WooCommerce in all releases through 7.16.2. Upgrading to a fixed version is required to eliminate the risk.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS data is not available, but the flaw is listed in the vendor’s advisory and the attack can be performed without authentication by submitting a crafted file through the form. Because it can lead to complete compromise of the site, the risk of exploitation is significant. The vulnerability is not currently in the CISA KEV catalog.

Generated by OpenCVE AI on October 30, 2026 at 18:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the theme to version 7.16.4 or later to apply the vendor patch that validates file types in the upload handler.
  • Disable or remove the convert_palette_images_to_truecolor upload feature if the site does not need it, preventing any file from being processed.
  • Configure the web application firewall or server to accept only image file extensions (.jpg, .jpeg, .png, .gif) and reject all other upload attempts.

Generated by OpenCVE AI on October 30, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Title Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-30T18:08:57.666Z

Reserved: 2026-10-22T11:15:03.585Z

Link: CVE-2026-115346

cve-icon Vulnrichment

Updated: 2026-10-30T18:01:40.523Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:22.220

Modified: 2026-10-30T19:18:12.173

Link: CVE-2026-115346

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:00:17Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type