Six bugs, one order of operations: Avada's zero-click chain is a same-day patch

The prerequisite sitting in the middle of Wordfence's advisory is the useful part. Exploitation needs a vulnerable Avada and a vulnerable Fusion Builder active on the same site at the same time ^[7], and the six steps have to run in a fixed order to end in PHP execution ^[3]. Break one link and the sequence dies ^[13]. Most WordPress shops treat theme updates and plugin updates as separate approvals with separate owners, so the practical instruction is to ship whichever of Avada 7.16.1 or Fusion Builder 3.16.1 clears change control first ^[6], then take the other one when the queue allows.

That is the only slack in the story. Argus, Wordfence's internal agentic framework, found the chain, reproduced it, and produced working proof-of-concept code in about two hours ^[9]. Reproduction landed on 30 July, the vendor received full details on 5 August, and ThemeFusion acknowledged the report on 10 August ^[10]. That is eleven days between a working exploit existing and the vendor confirming it exists ^[12]. Discovery now runs on an agent's clock. Vendor intake and release still run on a human one.

Wordfence is withholding complete technical detail and has published only a six-step outline of the chain ^[8]. That buys administrators time against anyone reading the writeup for hints, and it also leaves operators with no request pattern to hunt for. Version inventory is the whole of your self-assessment. If both components were reachable at vulnerable versions before the fixes shipped, the post-exploitation list Wordfence describes includes rogue administrator accounts and database access ^[4], and an update does not undo either.

The million-plus figure attached to Avada is a sales count, and Wordfence's own read is that the two-component requirement significantly narrows the pool of exploitable targets ^[11]. No figure has been published for the size of that overlap ^[14], so the vendor, the researcher and the operator are all reasoning from the same gap. For anyone who runs the pair, the population statistic does not apply anyway: you are either in the intersection or you are not, and checking takes minutes.