Avada Builder Plugin Vulnerable to Critical Auth Bypass in Versions Up to 7.16.1
Unauthenticated attackers can trigger arbitrary WordPress action hooks via the Avada Builder plugin, risking permanent site content deletion and denial of service.
Key points
- The vulnerability allows unauthenticated users to invoke arbitrary WordPress action hooks.
- Attackers can permanently delete trashed posts, pages, and comments using core hooks.
- All versions of the Avada (Fusion) Builder plugin up to and including 7.16.1 are affected.
The Avada (Fusion) Builder plugin for WordPress contains a critical authorization bypass vulnerability that allows unauthenticated attackers to execute arbitrary code paths within the platform. According to National Vulnerability Database (NVD) records, the flaw exists in all versions of the plugin up to and including 7.16.1.
At a glance
- CVE
- CVE-2026-97670
- Product
- themefusion Avada (Fusion) Builder
- CVSS
- 9.1 Critical
- Weakness
- code injection
- Exploited
- No known exploitation
The vulnerability stems from the plugin’s failure to properly verify authorization before dispatching a WordPress action hook. The hook name is derived from an attacker-supplied form field value, specifically through the `notification email_message` field placeholder and the `{action_hook,...}` dynamic-data token. The plugin’s trust gate function, `is_content_request_supplied()`, only inspects `$_POST['args']` and `$_GET['args']`. It fails to inspect the `$_POST['formData']` data that the public form-submit endpoint parses, leaving the execution path open to manipulation by external actors.
Technical Impact and Exploitation
This authorization bypass enables unauthenticated attackers to invoke multiple arbitrary WordPress action hooks per request. The consequences can include significant state changes, up to the permanent and irreversible destruction of site content. Security researchers have verified that an unauthenticated request can trigger the core `wp_scheduled_delete` action, which permanently deletes trashed posts, pages, and comments.
Beyond content deletion, other non-deny-listed hooks can extend the impact to denial-of-service conditions. For example, triggering the `wp_maybe_auto_update` hook can disrupt site availability. If vulnerable third-party handlers are installed on the site, the exploitation of these hooks can lead to further privileged writes.
The same unauthenticated dynamic-data pipeline also exposes a blind arbitrary read of user and post meta data. However, the results of this read are delivered only to the site owner and are not exfiltratable by the attacker through the plugin’s own email or response paths.
Exploitation requires specific conditions: a published Avada form with AJAX submission and a notification template that includes an `[all_fields]` or explicit `[field]` placeholder in the `email_message`. These conditions represent the default form configuration for the plugin, meaning many installations may be vulnerable by default.
Affected Versions and Scope
The vulnerability, tracked as CVE-2026-97670, is rated as critical with a CVSS score of 9.1. It is classified under weakness CWE-94. The issue affects the Avada (Fusion) Builder plugin developed by Themefusion. All versions up to and including 7.16.1 are confirmed to be vulnerable. There is no mention of a patched version in the source material provided.
What should you do?
Site administrators should immediately audit their WordPress installations for the presence of the Avada (Fusion) Builder plugin. Check the plugin version to determine if it falls within the affected range (up to 7.16.1). Review form configurations, specifically those using AJAX submission and default notification templates, as these are the vectors for exploitation. Monitor server logs for unusual activity related to form submissions or unexpected deletions of trashed content. Once the vendor provides an update, apply it promptly to mitigate the risk.
What to do and how to stay safe: Avada
- Verify the installed version of the Avada (Fusion) Builder plugin and compare it against the affected range (up to 7.16.1).
- Inspect WordPress forms for AJAX submission settings and default notification templates containing field placeholders.
- Monitor site logs for unauthorized invocations of core action hooks like `wp_scheduled_delete` or `wp_maybe_auto_update`.
- Restrict access to form submission endpoints where possible until a vendor fix is available.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-97670?
The CVSS score for CVE-2026-97670 is 9.1, which is rated as critical.
Which versions of the Avada plugin are affected?
All versions of the Avada (Fusion) Builder plugin up to and including 7.16.1 are affected.
Can attackers steal data directly from this vulnerability?
No, the blind read results are delivered only to the site owner and are not exfiltratable by the attacker through the plugin's paths.
