HIGH 8.1 NVD
CVE-2026-115346
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
References
- https://avada.com/blog/version-7-16-4-security-update/
- https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
- https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.