A critical CSRF vulnerability in Avada Core allows unauthenticated attackers to perform unauthorized actions on behalf of legitimate users.

The plugin suffers from CWE-352, Cross-Site Request Forgery. Because the application lacks sufficient anti-CSRF tokens for critical functions, an unauthenticated attacker can trick a logged-in administrator into executing unintended, malicious actions.

The CVSS score of 9.6 reflects the high potential for system compromise. An attacker could force an administrator to create new user accounts, change site configurations, or inject malicious scripts, leading to a total loss of site integrity and potential data breach.

Immediate Action: Update the Avada Core plugin to version 5.15.7 or the latest available version to implement necessary CSRF protection.

Proactive Monitoring: Monitor site activity logs for unauthorized administrative changes or unexpected user account creation events.

Compensating Controls: Ensure that administrative sessions are kept short and implement strict IP-based access controls for the WordPress dashboard where possible.

Public Exploit Available: Unknown

Administrators should treat this vulnerability with high urgency. Updating to version 5.15.7 is the only reliable method to resolve the underlying lack of CSRF protection. Please verify that all administrative sessions are terminated after applying the patch.