A critical arbitrary file write vulnerability in the Avada theme and Fusion Builder allows unauthenticated attackers to execute arbitrary code and compromise the entire WordPress site.

The vulnerability arises from an authorization and input validation failure occurring when both the Avada theme and Fusion Builder are active. This flaw permits unauthenticated attackers to write arbitrary files to the web server, which can be leveraged to upload and execute malicious PHP scripts.

The ability to write arbitrary files to the server grants an attacker full control over the WordPress environment. With a CVSS score of 9.8, this vulnerability facilitates remote code execution, which can lead to complete site takeover, database theft, and the use of the server for further malicious activities.

Immediate Action: Update both the Avada theme and the Fusion Builder plugin to the latest versions released by ThemeFusion.

Proactive Monitoring: Monitor server file system integrity for the creation of unauthorized PHP files, particularly in the uploads and theme directories.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block suspicious requests targeting the Fusion Builder components, though this is only a stopgap measure.

Public Exploit Available: No

This vulnerability is highly severe and requires immediate attention. Site administrators must prioritize updating the Avada theme and Fusion Builder plugin to the latest versions to prevent potential remote code execution attacks.