Hello Again,

This post implies we were negligent in notifying customers and the connotations made assume the worse. We disagree.

First, like WordPress, we understand that security is not an absolute, it's a continuous process and should be managed as such. While we try to be proactive in preventing security problems, we do not assume they’ll never come up.

It boils down to this. We were notified by a person of the security issue within Avada, via email. They asked for a bounty reward and showed us a post of what would be published. This post was wrong as it had exact details on how to use the vulnerability along with a script that made the person who reported it an admin user. For more information on that, see our first comment above.

Our development team immediately took action to check and verify the issue at hand. Once accurately identified, our team fixed it with a patch in less than 24 hours, and the full Avada 5.1.5 update was sent out in 4 days. Confirmation of the patch release date can be found here under 5.1.4: goo.gl/NGU83S … and confirmation of the changelog release that lists out the security fixes can be found here: goo.gl/40T2gp

There are several important factors to know:

1. We (ThemeFusion) do not have all customer emails. In fact, we have less than 1/5th. Envato keeps them and does not give them to the authors who sell items.

2. Due to the above, we have no way of contacting all of our customers at once. In addition, we had concerns over the post of the reporter which explains how to use the exploit, and not knowing when they were sending it out, we had to reply on Envato to do so.

3. Each time we send in an update, it lists out the changelog in detail. Both security issues were listed and their fixes approved by the Envato review team and the new version posted on the marketplace.

4. We did a similar thing to what WP did back in February and elected to put off disclosing the vulnerability to make sure that our users who use automatic updates on their sites – were protected before going public.

We allowed customers to see auto updates for both the theme and the patcher tool and get as many updated as possible. The patcher tool description and changelog were descriptive in making users aware that security issues were fixed. Nor is this information buried as we described above, in fact they use the standard WordPress method of letting you know updates or patches are available and ready to apply. The changelog link is directly on the updates page in WP admin, the themes page as well, and the patcher tool describes each one in it’s location in WP admin. In addition, all of this is online at our support center.

5. This all being very recent, and in agreement with Envato about the security related customer notification, we expected the actual communiqué to be sent out to each person that has purchased Avada, which it has been. However we implicitly asked Envato to allow us to review the content of the email before it was sent. We wanted to review the content of the eBlast so that we can ensure our customers are being given the correct information and to include additional helpful information about the update or users who were updating from much older versions. Lastly, we asked to know exactly when it was sent out so we could time ours as well. Unfortunately Envato did not get in touch with us in time.

6. The day Envato did send out the eBlast to every customer, we received it as any customer would and then also posted the information on our site: https://theme-fusion.com/knowledgebase/security-fixes-added-5-1-5/

The blog post of WPTavern claims that our customers only learned about it through Envato’s mail, WPScan Vulnerability Database or the reporter himself. We find that bizarre for several reasons.

First of all, we did inform our users about the available update that included the security fix through the several ways that we could: changelog, patcher tool, a user through our private Facebook group. WPTavern arbritarily says, “we buried the information in our changelog” … first, it is not buried as we explained above. Second the changelog is the exact place to put the information, especially when you are unable to make it known to all customers since we do not have their emails and taking into consideration everything else explained.

Even before we released 5.1.5, the security patch fix was done in 24 hours or less through our live patcher tool. Like it is in WordPress, it can be easily seen, that a patch/update is available. Both were labeled starting with “Security fix”, containing the kind of security issue “(ex: XSS)”.

Why did we wait some time before a publicly available disclosure was done from our side (which can be found here: https://theme-fusion.com/knowledgebase/security-fixes-added-5-1-5/)?

To protect our customers. How can this course of action protect customers? Well, we do know from website traffic checks, that our user base does update to new versions very fast. So making the update available, and using the more private information channels listed above (auto patch notifications, auto theme updates), we made sure that the majority of our users was already protected before the general public (which of course includes potential hackers) was made aware of the security issue.

This is not an uncommon approach, but also something WordPress does (see https://threatpost.com/wordpress-silently-fixed-privilege-escalation-vulnerability-in-4-72-update/123533/, http://www.securityweek.com/wordpress-delayed-disclosure-critical-vulnerability or https://www.imperva.com/blog/2017/03/early-vulnerability-disclosure-thwarts-wordpress-hackers/ as examples).

Our customers know we are not negligent in any way, they know we do everything possible for them and this involves any and all security issues. We campaign tirelessly for all of our customers, to maintain their installs and ensure that the theme is always updated or a patch applied.

The issue itself has been resolved over a month ago, a patch created in 24 hours or less once we were notified and our user base was informed about it (automatically) through our changelog, our live patcher tool and a post in our private Facebook group. That is as much as we can do since we do not have all customer emails and rely on our partner (Envato) to also help out for which they sent the full eBlast to all customers.

Implying we are hiding something strongly assumes the wrong thing. We will keep doing what we always have done and build strong relationships with our customers through trust and communication.

ThemeFusion