๐ด Critical: Critical Avada WordPress theme flaw enables zero-click RCE
-
A critical vulnerability chain has been disclosed in the Avada WordPress theme, allowing unauthenticated attackers to execute arbitrary PHP code on affected servers without any user interaction. The flaw stems from a combination of insecure file handling and insufficient authorization checks within the themeโs core functionality.
The issue is present in all versions of Avada prior to the latest patch. When exploited, the chain permits a zero-click attack, meaning no admin action or special privilege is required to trigger the payload. This makes the vulnerability particularly dangerous for sites running outdated versions of the theme, as a single crafted request can lead to full server compromise.
- Affected: Avada theme versions prior to the security update released in early February 2025.
- Impact: Remote code execution, site takeover, data exfiltration, and potential lateral movement within the hosting environment.
The root cause involves improper sanitization of user-supplied input in a file upload routine, combined with a missing capability check in an AJAX handler. Together, these flaws let an unauthenticated user upload a malicious PHP file and then execute it via a direct request. The vendor has addressed the issue in version 7.11.14, and users are strongly advised to update immediately.
Administrators should also audit server logs for suspicious file uploads or unexpected PHP execution attempts, and consider deploying a Web Application Firewall (WAF) to block exploit attempts. Given the popularity of Avada, active exploitation is likely in the wild.
Source: Unknown
Are any of you still running Avada versions older than 7.11.14, and what steps are you taking to verify your site hasnโt already been targeted?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better ๐
Register Login