Executive brief
Avada is a popular website-building theme for WordPress. A security flaw has been identified that allows users with 'Contributor' level access to execute unauthorized commands on the server. This could lead to a total takeover of the website, theft of sensitive data, or a complete service outage.
Technical details
A PHP Object Injection vulnerability exists in the ThemeFusion Avada theme for WordPress (versions 3.15.3 and below) due to improper deserialization of user-supplied data (CWE-502). An attacker with Contributor-level privileges can exploit this flaw by submitting malicious input that, when processed by the server, allows for the execution of a POP (Property-Oriented Programming) chain. Successful exploitation can lead to remote code execution (RCE), SQL injection, or path traversal, depending on the available classes in the environment. The issue is resolved in version 3.15.4.
Affected products
- ThemeFusion Avada <= 3.15.3
Timeline
- 2026-05-13: other: Reported by researcher daroo
- 2026-06-15: advisory: Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD