---
id: "CVE-2026-115346"
kind: "vulnerability"
aliases: ["CVE-2026-115346"]
title: "Avada WordPress theme: unauthenticated file upload allows remote code execution"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["avada", "package", "self-hosted", "wordpress"]
not_affected_if: ["avada-not-installed", "theme-updated"]
published_at: "2026-10-30T18:17:22+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:56:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115346", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# Avada WordPress theme: unauthenticated file upload allows remote code execution

The Avada WordPress theme, up to and including version 7.16.2, lets unauthenticated visitors upload files through the convert_palette_images_to_truecolor() function because file types are not checked properly. An attacker can upload an executable file and run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Avada theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.
- Treat any version up to and including `7.16.2` as exposed.

## Fix

- Move the Avada theme to a version later than `7.16.2`; the sources do not name the exact fixed version.

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115346

## From the sources

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_