The issue is present in all versions of Avada prior to the latest patch. When exploited, the chain permits a zero-click attack, meaning no admin action or special privilege is required to trigger the payload. This makes the vulnerability particularly dangerous for sites running outdated versions of the theme, as a single crafted request can lead to full server compromise.

• Affected: Avada theme versions prior to the security update released in early February 2025.
• Impact: Remote code execution, site takeover, data exfiltration, and potential lateral movement within the hosting environment.

The root cause involves improper sanitization of user-supplied input in a file upload routine, combined with a missing capability check in an AJAX handler. Together, these flaws let an unauthenticated user upload a malicious PHP file and then execute it via a direct request. The vendor has addressed the issue in version 7.11.14, and users are strongly advised to update immediately.

Administrators should also audit server logs for suspicious file uploads or unexpected PHP execution attempts, and consider deploying a Web Application Firewall (WAF) to block exploit attempts. Given the popularity of Avada, active exploitation is likely in the wild.

Source: Unknown

Are any of you still running Avada versions older than 7.11.14, and what steps are you taking to verify your site hasn’t already been targeted?