Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-115346

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to…

Risk score
54/100
CVSS
8.1 v3.1
Published
30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible f…
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 8.1 high
  • Remotely exploitable without logging in

References

Original description

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Last activity 30 Oct 2026. Patch Forecast updates every hour.