Filtered by category: WordFence, tag: wordpress theme vulnerability × Clear
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Matched: WordPress
Wordfence's AI agent Argus discovered a critical unauthenticated remote code execution vulnerability in the Avada WordPress theme and its Fusion Builder plugin, affecting all versions through 7.16 and 3.16 respectively. The exploit chains six weaknesses to allow arbitrary PHP execution without login. Argus found and proved the full chain in roughly two hours. Patches were released August 25, 2026 in Avada 7.16.1 and Fusion Builder 3.16.1.