BitFire PRO RASP blocks unauthorized PHP-file writes that turn the Avada and Fusion Builder flaw into persistent server compromise.
CVE-2026-18431 is a critical unauthenticated arbitrary file-write vulnerability affecting Avada through version 7.16 when Fusion Builder through version 3.16 is installed and active. A chain of authorization and input-validation weaknesses across the two components lets an attacker write controlled files to the server. The disclosed result includes creating and executing arbitrary PHP files, leading to remote code execution and complete site compromise. Exploitation also requires certain administrator-authored content to be present. BitFire PRO RASP enforces protection at the decisive runtime operation: it blocks an unauthenticated request from creating or modifying PHP, preventing the file-write chain from establishing executable PHP or persistent backdoors.
The affected component, attack path, and practical risk for WordPress websites.
BitFire PRO RASP stops the critical file-write outcome: an unauthenticated request cannot create or modify PHP to establish executable malware or persistent server access.
Research details, affected versions, exploitation behavior, and remediation guidance.
Alex Thomas disclosed CVE-2026-18431 as an unauthenticated arbitrary file-write vulnerability spanning the Avada theme and Fusion Builder plugin. Avada is affected through 7.16, while Fusion Builder is affected through 3.16. Successful exploitation requires both affected components to be installed and active, plus certain content previously authored by an administrator. Under those conditions, combined authorization and input-validation weaknesses allow attacker-controlled files to be written to the server. The disclosed impact is direct and severe: an attacker can create and execute arbitrary PHP files, gain remote code execution, and completely compromise the WordPress site. The brief does not identify a route, request method, parameter, filename, or payload format, so those mechanics remain unspecified.
BitFire PRO RASP acts when PHP attempts the protected filesystem operation, after request processing has begun but before an unauthorized PHP file is committed. Its filesystem protection inspects PHP-file writes and denies creation or modification initiated by an unauthenticated or non-administrator request. That directly contains the disclosed takeover path: the vulnerable cross-component chain cannot turn attacker control into an executable PHP file, web shell, backdoor, or malicious plugin payload. This protection does not claim to repair Avada's authorization checks, sanitize its input, or prevent the vulnerable path from being reached. It enforces the security boundary at the operation that converts the weakness into persistent executable code, without relying on a CVE-specific signature.
The disclosure establishes unauthenticated file writing but does not state how the attacker delivers input. It does not identify a form submission, POST request, AJAX or REST call, API action, upload, URL parameter, or recognizable web-attack payload. For that reason, this assessment does not present BitFire Bot Protection or WAF inspection as direct coverage for CVE-2026-18431. General bot controls can reduce automated scanning and attack traffic, but the supplied facts do not prove that bot policy blocks this particular path. Likewise, an arbitrary file write is not automatically a malicious file upload. The supported protection claim is precise: BitFire PRO RASP blocks unauthorized PHP-file creation or modification at runtime.
Install releases that the vendor identifies as fixed for both Avada and Fusion Builder immediately, and verify that the two components are updated together. Patching closes the known vulnerable path but does not remove a compromise established while an affected configuration was exposed. Run BitFire Threat Hunter to investigate backdoor WordPress administrator accounts, hidden database triggers, WordPress and server cron jobs, long-running PHP processes, must-use plugins, startup-chain changes, and droppers capable of restoring malware or reinfecting the site. Remove every discovered persistence mechanism, preserve and review relevant logs, and rotate WordPress, hosting, database, deployment, and other relevant credentials. The absence of one obvious malicious PHP file does not prove that the site is clean.
CVE-2026-18431 gives unauthenticated attackers a path from cross-component validation failures to arbitrary PHP execution when all disclosed conditions are met. Update both Avada and Fusion Builder to vendor-confirmed fixed releases without delay. Enable BitFire PRO RASP to deny the unauthorized PHP-file writes that make remote code execution and persistent server control possible. Any site that ran the affected combination with qualifying administrator-authored content should also undergo a Threat Hunter investigation. Strong runtime enforcement, immediate patching, and a thorough compromise review address prevention and prior exposure without overstating unknown request mechanics.
BitFire protects WordPress servers on day zero—before a vulnerability is publicly known and before other vendors have time to develop signatures or patches.
Bot controls and browser verification stop untrusted automated clients before previously unknown exploit code reaches WordPress.
General WAF protections identify dangerous request behavior and hostile payloads without waiting for a vulnerability-specific signature.
RASP follows execution inside PHP and prevents unauthorized changes to protected files, accounts, and database content.
BitFire combines bot controls, request inspection, malware detection, and runtime protection in one WordPress security platform.