A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server.

The exploit chains six security issues into a zero-click attack. The flaws are collectively tracked as CVE-2026–18431 and received a 9.8 critical severity score.

The attack comprises exploits for authorization, input-validation, trust-boundary, and file-handling weaknesses, which must be executed in a specific order to enable arbitrary PHP code execution on a target server.