CVE-2026-115346

8.1 HIGH

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

All references

https://avada.com/blog/version-7-16-4-security-update/
https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311?source=cve

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2014-125138PoC
CRITICALCVE-2023-54405PoC
HIGHCVE-2025-15700
UNSCOREDCVE-2025-68391
HIGHCVE-2026-100389
MEDIUMCVE-2026-101071PoC
HIGHCVE-2026-102130PoC
MEDIUMCVE-2026-102137PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.