Avada (Fusion Builder) EUVD-2026-66293

Exploitation requires that BOTH the Avada theme (<=7.16) and the Avada Fusion Builder plugin (<=3.16) are installed and active on the target - neither alone is sufficient - AND that specific administrator-authored content produced by the builder already exists on the site, which the attacker cannot create themselves. Given the CVSS vector (PR:N/UI:N) the attack is unauthenticated and needs no user interaction, and the file-write primitive must be able to place a .php file in a PHP-executable directory for RCE. The limiting factors are therefore the mandatory presence of both components together and the required pre-existing admin content; sites missing either component or that content are not exploitable via this chain.

The signals are strong but not uniform. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 critical) reflects unauthenticated network RCE, which is the worst case. However, the description adds a material precondition - 'certain administrator-authored content to be present' and both specific components installed/active - which meaningfully raises real attack complexity above the AC:L the base score assumes; a more honest assessment treats this as an attack requirement (AC:H in 3.1 / AT:P in 4.0), lowering practical exploitability against an arbitrary target. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation yet. Net: this is a genuine high-priority patch target for sites running Avada + Fusion Builder given the RCE impact and unauthenticated vector, but it is not confirmed as widespread in-the-wild exploitation, and the content precondition means not every install is immediately exploitable.

An attacker identifies a public WordPress site running the Avada theme with Fusion Builder active and containing the qualifying administrator-authored builder content. Without any credentials, they send a crafted request to the vulnerable builder handler that abuses the missing authorization and weak path/content validation to write a PHP webshell into the site's webroot, then request that file to execute code and take over the server. No public POC was provided, but the unauthenticated network vector makes this attractive to opportunistic scanners once details circulate.