Immediate Containment
! Restrict public access to affected WordPress administration and application surfaces where operationally feasible.
Exposure Reduction & Patching
🛡️ Review Avada and WordPress inventories and identify versions pending vendor confirmation.
📦 Apply the vendor or theme-maintainer fix when available; do not infer a version from this source summary.
Configuration & Credentials
⚙️ Use layered web-application protections and least-privilege PHP execution controls.
🔑 Review administrative sessions and credentials only if follow-on investigation identifies suspicious activity.
Evidence Preservation
📁 Preserve web, PHP, WordPress, and WAF logs for the reported period.
Verification & Rollback
✓ Confirm the vulnerable component and remediation against authoritative vendor documentation.
↩️ Rollback: Use the documented WordPress/theme rollback process after preserving evidence.