Avada Theme CVE-2026-115346

Exploitation requires reaching the theme's convert_palette_images_to_truecolor() function with an uploaded file whose type is not sufficiently validated before processing, allowing an executable file to be written and later invoked for code execution. No authentication is required (CVSS PR:N), so the attack is available to unauthenticated attackers against affected installs of the Avada theme at versions up to and including 7.16.2. The limiting factor is the CVSS AC:H rating, which indicates an additional attacker-uncontrolled or configuration-dependent precondition must hold for the attack to succeed; however, the specific trigger for this high complexity is not described in the available sources, so defenders should treat the exact prerequisite as unverified.

This is a credible priority but not an all-hands emergency. The CVSS 3.1 vector (AV:N/PR:N/UI:N) describes a remotely reachable, unauthenticated flaw, and the CWE-434 arbitrary file upload leading to RCE drives the C:H/I:H/A:H impact and the 8.1 base score. The single mitigating signal in the vector is AC:H (high attack complexity), which is what holds the score below the 9.0+ 'critical' band an unauthenticated RCE would otherwise command - but the available sources do not state WHAT precondition makes the attack complex, so the real-world ease of exploitation cannot be confirmed from this data. The priority decision label is 'this_week' (vuln.today), consistent with a serious-but-not-drop-everything triage. Key signals are MISSING and should temper urgency assessment: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV (no confirmed active exploitation), and no SSVC decision framework values (automatable, technical impact) are supplied. No public exploit reference is present in the input either. The combination - unauthenticated network RCE in an extremely popular WordPress theme, offset by AC:H and the absence of any exploitation evidence - means this warrants prompt patching but the claim of real-world mass exploitation is not supported by the provided data.

A remote, unauthenticated attacker sends a crafted request that reaches the theme's convert_palette_images_to_truecolor() processing path and uploads a file whose type is not adequately validated, placing an executable (e.g. PHP) file on the server. The attacker then requests that file to trigger remote code execution in the web server context. The CVSS vector rates attack complexity as high (AC:H), implying an additional precondition must be met, though the sources do not describe it; no public exploit was identified in the provided data.