PT-2026-133700

CVE-2026-115346

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
8.1
High
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert palette images to truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2026-115346
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com