A year ago we wrote that we’d put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted reports to our bug bounty program had gone from 16% to about two-thirds of everything we received, and it wasn’t slowing down.
As we continue to see AI driven innovation in cybersecurity, the Wordfence team continues to accelerate our own pace of AI enabled innovation. PRISM, our autonomous research agent, is now the most prolific researcher we have, with over 300 vulnerabilities to its name and the top spot on our leaderboard over the last 30 days. In July it caught a supply-chain backdoor in a 20,000-install plugin less than two hours after the malicious code went in. Around the same time, a prompt technique borrowed from a math breakthrough turned up the first unauthenticated, no requirement, WordPress core RCE in a decade after roughly ten hours of machine time.
This post is one more data point on that trend line, and for us, it’s where things get interesting: We are now using AI to do the kind of deep, multi-step exploitation that used to take a skilled human weeks or months. And we are compressing that work into a few unattended hours.
Using an agentic framework we developed, code named Argus, we found and reproduced a critical, unauthenticated remote code execution vulnerability chain in Avada, one of the best-selling WordPress themes ever made with over a million sales. An unauthenticated attacker could run arbitrary PHP on the server without ever logging in or getting a victim to click anything. Argus found the whole chain and proved it, start to finish, in about two hours.
Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule to provide protection against known exploitation techniques on July 30, 2026, the day we confirmed the vulnerability. Free users will get the same rule 30 days later, on August 29, 2026.
We provided full disclosure details to the ThemeFusion team through our Wordfence Vulnerability Management Portal on August 5, 2026. The developer acknowledged the report on August 10, 2026 and released a public patch on August 25, 2026. We would like to commend the ThemeFusion team for their prompt response and timely patch.
Breadth and Depth
We think about AI research two ways, and we build for both.
BREADTH for coverage: PRISM is the breadth-first half. It sweeps an enormous surface across every bug class and threat model, on its own, all day. That’s how you cover a whole ecosystem, and how you notice a backdoor two hours after it makes its way onto the WordPress plugins repository.
DEPTH for complexity: Argus is the depth-first half, and it’s the one that found the Avada chain. Both agents hunt the way every researcher does, tracing a dangerous operation backward to see whether anything untrusted can reach it, or following untrusted input forward to see what it can touch. What differs is how far down that trace they push. PRISM goes wide: it covers an enormous surface, which usually means each finding is anywhere from one to a few flaws or a short hop of a step or two, and that’s exactly the right trade-off, because most serious WordPress vulnerabilities look like that and you want to catch every one of them. Argus goes deep instead. It gives up the breadth to stay on one target and hold a long, multi-step path in view, the kind where the exploit only exists several links in and every link depends on the one before it.
Avada was that deep case: six separate weaknesses, none sufficient on its own to produce code execution, that only become a path from an anonymous request to code execution when you line them up in one exact order. We won’t claim a human could never have found it. Hand an experienced researcher the hint that an RCE is in there and a month to chase it, and maybe they connect all six links, maybe they don’t. What we can say is that Argus found the chain unattended in about two hours, and then did the part that usually costs a researcher days on its own: it wrote a working proof-of-concept, start to finish, that executes PHP code on the target server. A chain this deep, found and demonstrated that fast with nobody in the loop, is what starts to look like capability beyond what a person can practically bring to bear. Not because the bug was invisible, but because no human works that fast.
We’re not going to publish how Argus is built. As one of our recent blog posts said, the leverage here isn’t really about any one model, it’s about harness and prompt engineering, about how you put a capable model to work. That’s our own R&D, and the same techniques help an attacker just as much as they help us.
Vulnerability Summary from Wordfence Intelligence
Patched
The Chain
Here’s a high-level overview. We are intentionally withholding additional technical details at this time:
- A public-facing request exposed attacker-controlled input.
- That input could reach internal behavior not intended for anonymous users.
- A privileged component could be invoked outside its expected context.
- Request data could influence trusted state for the duration of the request.
- An administrative maintenance operation lacked sufficient authorization.
- Its file-handling controls did not adequately constrain what could be written or where.
The completed chain allows attacker-controlled PHP to execute in the security context of the web server. Because every link is required, breaking any one of them blocks the demonstrated path. ThemeFusion’s patch addresses all six weaknesses, including the authorization, trust-boundary, and file-handling issues involved.
Timeline
Vendor / external action
Conclusion
In this blog post, we detailed a critical vulnerability chain that results in remote code execution affecting the Avada theme in all versions up to, and including, 7.16 when used together with its bundled Fusion Builder plugin in all versions up to, and including, 3.16. This vulnerability allows unauthenticated threat actors to chain a series of individually minor weaknesses into arbitrary PHP code execution on the server, leading to complete site compromise. The vulnerability has been fully addressed in Avada 7.16.1 and Fusion Builder 3.16.1.
We encourage WordPress users to verify that their sites are updated to the latest patched versions of both the Avada theme and the Fusion Builder plugin as soon as possible, considering the critical nature of this vulnerability. Because Avada requires and ships with Fusion Builder, both should be updated together.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule protecting against known exploits targeting this vulnerability chain on July 30, 2026. Sites running the free version of Wordfence will receive the same protection 30 days later, on August 29, 2026.
If you know someone who uses Avada on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
The post Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales appeared first on Wordfence.