Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the Avada Builder plugin for WordPress allows unauthenticated attackers to execute arbitrary code on a website. This is concerning because it means anyone, without needing a login, could potentially take full control of the site.
- Websites using this plugin are at risk.
- Unauthenticated access is possible.
- This can lead to complete site compromise.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by sending a crafted request to a specific AJAX endpoint on a WordPress site. This request would contain a base64 encoded JSON payload that, when processed, allows for the injection and execution of arbitrary PHP functions. This effectively grants the attacker code execution on the server, impacting the integrity and availability of the site.
- Unauthenticated attackers can exploit.
- Targets AJAX endpoint.
- Requires public page with specific shortcodes.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is very likely to be weaponized by attackers. WordPress plugins with unauthenticated remote code execution flaws are highly attractive targets for automated scanning and exploitation due to the sheer volume of WordPress sites and the potential for widespread compromise. The deterministically exposed nonce further lowers the barrier to entry for exploitation.
- Unauthenticated RCE in popular plugin.
- Publicly accessible AJAX endpoint.
- Deterministic nonce exposure.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of the Avada Builder plugin to version 3.15.3 or later, as this unauthenticated RCE vulnerability is critical and actively exploited. If patching is delayed, isolate affected WordPress instances from public access or implement a Web Application Firewall (WAF) to block requests targeting the `fusion_get_widget_markup` AJAX endpoint. Continuous monitoring for indicators of compromise related to PHP code execution is essential until remediation is complete.
- Update Avada Builder to 3.15.3.
- Isolate affected systems or deploy WAF rules.
- Monitor for unauthorized code execution.
