{"id":"CVE-2026-115346","kind":"vulnerability","aliases":["CVE-2026-115346"],"related":[],"title":"Avada WordPress theme: unauthenticated file upload allows remote code execution","description":"The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","summary":"The Avada WordPress theme, up to and including version 7.16.2, lets unauthenticated visitors upload files through the convert_palette_images_to_truecolor() function because file types are not checked properly. An attacker can upload an executable file and run code on the server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avada","package","self-hosted","wordpress"],"not_affected_if":["avada-not-installed","theme-updated"],"how_to_check":"- Check the installed Avada theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Treat any version up to and including `7.16.2` as exposed.","fix":"- Move the Avada theme to a version later than `7.16.2`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-30T18:17:22+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:35+00:00","updated_at":"2026-10-30T18:56:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T18:56:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Avada theme to a version later than `7.16.2`; the sources do not name the exact fixed version.","reach":"internet","title":"Avada WordPress theme: unauthenticated file upload allows remote code execution","impact":"high","summary":"The Avada WordPress theme, up to and including version 7.16.2, lets unauthenticated visitors upload files through the convert_palette_images_to_truecolor() function because file types are not checked properly. An attacker can upload an executable file and run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","avada","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker uploads executable file and runs code on the server","analyst_note":"Confirm the fixed Avada version and whether the upload path requires any specific feature enabled, using the NVD entry and the vendor changelog.","how_to_check":"- Check the installed Avada theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Treat any version up to and including `7.16.2` as exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["theme-updated","avada-not-installed"],"who_is_affected":"Sites running the Avada theme for WordPress at version 7.16.2 or earlier are exposed, since the vulnerable upload path is reachable without logging in. Sites that do not use Avada, or run a later version, are not affected. The sources do not describe any required configuration beyond running the theme.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4173,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115346':13A,16A '-2026':12A,15A '7.16.2':32B,88C 'allow':7A 'arbitrari':79C 'attack':54B,115C 'avada':1A,17B,24B,67C 'builder':69C 'check':51B 'code':9A,62B,126C 'convert':40B,91C 'cve':11A,14A 'due':99C 'execut':10A,58B,122C,127C 'file':5A,37B,47B,59B,80C,102C,108C,118C 'function':45B,96C 'host':21B 'imag':42B,93C 'includ':30B,87C 'insuffici':101C 'let':33B 'make':110C,124C 'may':120C 'packag':18B 'palett':41B,92C 'possibl':112C,128C 'process':106C 'proper':52B 'remot':8A,125C 'run':61B 'self':20B 'self-host':19B 'server':65B 'theme':3A,26B,73C 'truecolor':44B,95C 'type':48B,103C 'unauthent':4A,34B,114C 'upload':6A,36B,56B,81C,107C,117C 'valid':104C 'version':31B,83C 'via':89C 'visitor':35B 'vulner':77C 'websit':68C 'woocommerc':72C 'wordpress':2A,22B,25B,71C,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Avada theme for WordPress at version 7.16.2 or earlier are exposed, since the vulnerable upload path is reachable without logging in. Sites that do not use Avada, or run a later version, are not affected. The sources do not describe any required configuration beyond running the theme.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115346","severity":null,"published_at":"2026-10-30T18:17:22+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}