Critical Avada WordPress Theme Flaw Enables Zero-Click RCE

Six-Step Exploit Chain Threatens 1M+ WordPress Sites

A critical vulnerability chain in Avada, the best-selling theme on ThemeForest with more than a million sales, can be exploited by an unauthenticated attacker to achieve remote code execution on the underlying server. The bundled Avada Builder (Fusion Builder) plugin — which sits on roughly a million active WordPress installations of its own — carries the same flaw.

Discovery

The vulnerability wasn't found by a human researcher first. Wordfence disclosed that its newly built AI research agent, code-named Argus, found and reproduced the full six-step attack chain in roughly two hours on July 30, 2026, writing a working proof-of-concept from scratch with no human involvement, according to Wordfence Senior Web Application Vulnerability Researcher Alex Thomas.

Technical Details

• CVSS Score: 9.8 (Critical)
• Affected: Avada theme up to and including version 7.16, bundled with Fusion Builder up to and including version 3.16
• Root cause: An RCE in the Fusion Patcher, the component that handles file-based patches for the theme

Unlike a simple one-request exploit, this is a six-step chain — the kind of flaw that evades naive signature-based scanning and single-request WAF rules because each individual step can look benign in isolation. Wordfence has not yet published the full technical write-up, so the exact sequence of the six steps remains undisclosed pending wider patch adoption. No user interaction from an administrator is required to trigger the chain once network access to the vulnerable endpoints is available.

Vendor Response

ThemeFusion, the company behind Avada, acknowledged Wordfence's report on August 10, 2026 and had a pre-release patch ready two days later. The official fix shipped as Avada 7.16.1 on August 25, 2026, with the changelog noting simply that "a remote code execution vulnerability in the Fusion Patcher has been fixed." As of publication, there is no assigned CVE, no formal severity score, and no technical advisory from ThemeFusion beyond that single changelog line.

Why It Matters

Avada's scale makes this one of the more consequential WordPress theme disclosures this year:

An unauthenticated, chained RCE at this footprint gives attackers a large, low-friction target pool — and the multi-step nature of the exploit means it can slip past defenses tuned to catch single malicious requests.

Recommended Actions

1. Update immediately to Avada 7.16.1 and the patched Fusion Builder release through Appearance > Themes or your license portal
2. Audit for compromise if patching was delayed — check for unexpected files under the theme's patcher directories and unfamiliar admin accounts
3. Deploy a WAF (Wordfence or equivalent) capable of tracking multi-step request chains, not just single-request signatures
4. Subscribe to ThemeFusion's changelog for the forthcoming technical advisory, expected once patch adoption is further along

References

• BleepingComputer — Critical Avada WordPress theme flaw enables zero-click RCE
• The Repository — Wordfence's New AI Agent Chains Six Flaws Into a Critical Unauthenticated RCE in Popular Avada Theme
• MagicWP — Avada 7.16.1 Fixes Fusion Patcher RCE: What to Do Now