Report flags critical zero-click RCE risk in Avada WordPress theme

An Avada flaw reportedly requiring no login or clicks

BleepingComputer reported a critical vulnerability chain in the popular Avada theme for WordPress. According to the report, an unauthenticated attacker could exploit it to execute arbitrary PHP code on a server, described as a zero-click remote-code-execution risk.

The saved record reports this vulnerability chain but does not establish its earlier disclosure history.

A report has disclosed an alleged critical vulnerability chain in the Avada WordPress theme that could allow unauthenticated, zero-click remote code execution.

The claimed lack of authentication and user-interaction requirements is central to the reported risk. This is the saved report’s description, rather than an independently verified exploitation result here.