An automated research agent spent about two hours on one WordPress theme and came out with a way to run code on any site using it. No login, no phishing email, no click from the site owner.
The theme is Avada, which its maker ThemeFusion has sold more than a million times, making it one of the best selling commercial WordPress themes ever built. Wordfence published the finding on August 25, the same day ThemeFusion released the patch. It is tracked as CVE-2026-18431 and carries a CVSS score of 9.8 out of 10, the critical band.
The bug is an arbitrary file write, which means an attacker gets to decide what lands on the server and where. Wordfence says that can be used to create and execute arbitrary PHP files, which is complete site compromise. Two conditions have to hold: both Avada (versions up to and including 7.16) and its bundled Fusion Builder plugin (up to and including 3.16) must be installed and active, and certain administrator-authored content has to already be present on the site.
Six small holes, one exact order
What makes this one unusual is that none of the six weaknesses behind it does anything on its own. In Wordfence's high level account, a public request exposed attacker-controlled input, that input reached internal behavior never meant for anonymous users, a privileged component could be invoked outside its expected context, request data could influence trusted state, an administrative maintenance operation lacked sufficient authorization, and its file-handling controls did not adequately constrain what could be written or where. Line all six up in one exact order and an anonymous request becomes code execution. Break any single link and the demonstrated path closes.
Wordfence is deliberately withholding the deeper technical detail for now, and its report describes no exploitation in the wild.
The finder was software
The chain was found by Argus, an agentic framework Wordfence built in house and describes as the depth-first half of its research effort. Rather than sweeping a whole ecosystem, Argus stays on one target and holds a long multi-step path in view. Researcher Alex Thomas is credited alongside it. According to the original report, Argus found the chain unattended in roughly two hours and then wrote a working proof of concept that executes PHP on the target, the part that normally costs a human researcher days.
Wordfence's breadth-first agent, PRISM, is now the most prolific researcher on its leaderboard with over 300 vulnerabilities to its name, and in July it caught a supply chain backdoor in a 20,000 install plugin less than two hours after the malicious code went in. The company says it will not publish how Argus is built, on the grounds that the leverage sits in the harness and the prompt engineering rather than any one model, and that the same techniques would serve an attacker just as well. We covered the volume side of this pipeline in a week that produced 249 WordPress flaws.
Update to Avada 7.16.1 and Fusion Builder 3.16.1
ThemeFusion released both patched packages on August 25, and because Avada requires and ships with Fusion Builder, the two need to be updated together. Wordfence Premium, Care and Response customers received a firewall rule on July 30, the day the vulnerability was confirmed; sites running the free version of Wordfence get the same rule on August 29.
The disclosure ran on a normal clock: Argus reproduced the chain on July 30, Wordfence sent full details to ThemeFusion on August 5, the vendor acknowledged on August 10, supplied a pre-release patch on August 12, and shipped publicly on August 25. That is a fast turn for a six part fix, and Wordfence commended the vendor for it.
The practical lesson for anyone running a large commercial theme is the same one the Forminator file upload flaw taught earlier this month. Individually harmless weaknesses stop being harmless the moment something patient enough lines them up, and patience is exactly what has just become cheap.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.