Live › vulnerability › CVE-2026-115346
The Avada WordPress theme, up to and including version 7.16.2, lets unauthenticated visitors upload files through the convert_palette_images_to_truecolor() function because file types are not checked properly. An attacker can upload an executable file and run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Avada theme for WordPress at version 7.16.2 or earlier are exposed, since the vulnerable upload path is reachable without logging in. Sites that do not use Avada, or run a later version, are not affected. The sources do not describe any required configuration beyond running the theme.
No product ranges from the sources yet.
7.16.2 as exposed.7.16.2; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
This page as .md · .json · in your agent: get_signal("CVE-2026-115346")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.