Critical Avada WordPress theme flaw enables zero-click RCE

{"heading":"The Exploit Chain","subheading":"Step-by-Step Attack Process","paragraph_1":"The vulnerability in Avada and Fusion Builder plugins can be exploited through a series of six steps, each requiring specific conditions to be met.","paragraph_2":"First, attackers expose attacker-controlled input through a public request. Then, they pass that input to functionality restricted from anonymous users. Next, they invoke a privileged component outside its intended context.","paragraph_3":"Subsequently, attackers use request data to influence trusted state and access an insufficiently protected administrative operation. Finally, they bypass file-handling restrictions to write and execute code on the server.","paragraph_4":"The vulnerability affects Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16. Both themes and plugins must be vulnerable for the attack to succeed.","paragraph_5":"Wordfence, the security team behind Avada and Fusion Builder, discovered the vulnerability and provided an overview of the attack chain. They also shared proof-of-concept exploit code.","paragraph_6":"ThemeFusion, the developer behind Avada and Fusion Builder, fixed the vulnerability and released updates in Avada 7.16.1 and Fusion Builder 3.16.1.","paragraph_7":"Once attackers have valid credentials, they can execute 37% of their actions, highlighting the importance of strong authentication and prevention measures."}