Avada (Fusion) Builder: Authorization bypass via form field action hook
Summary
The Avada (Fusion) Builder WordPress plugin does not verify authorization before running a WordPress action hook whose name comes from a submitted form field. An unauthenticated attacker can trigger arbitrary action hooks, which can permanently delete trashed posts, pages and comments and cause denial of service. The flaw is reachable when a published Avada form uses AJAX submission and a notification template with an [all_fields] or [field] placeholder, which is the default configuration. The CVE record rates it 9.1 (Critical), but the vendor has not confirmed the affected Fusion Builder version range.
Affected
- Avada (Fusion) Builder WordPress plugin up to and including 7.16.1 according to the CVE record (CNA data)
- Secondary sources state Fusion Builder up to and including 3.16.1; this version boundary is unconfirmed
- Default configuration of Avada Forms with AJAX submission and a notification template using [all_fields] or [field]
Fixed in
Unknown.
- Secondary sources state Fusion Builder 3.16.2; not confirmed by the vendor or Wordfence
- Avada 7.16.2 (security update, September 30, 2026) includes fixes for Avada Forms submission and notification emails, but does not name this CVE
Workaround
- No vendor workaround published.
- Review public forms and remove notification fields that insert submitted data into email templates until the update is applied (own inference, not vendor guidance).
Exploitation
- No confirmed exploitation in the wild; not listed in CISA KEV according to the tracker consulted.
- No public proof-of-concept found. A researcher verified the deletion impact.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory WordPress sites running Avada and record the Avada theme and Fusion Builder versions.
- Update Avada and Fusion Builder to the latest release and confirm the installed Fusion Builder version.
- Audit public forms for notification templates that use [all_fields] or [field] placeholders.
- Empty the trash only after the update is verified, and keep current backups.
- Monitor for unexpected deletions of content or unusual form submissions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- Avada 7.16.2 Security Update avada.com
- VulDB CVE-2026-97670 vuldb.com
- Vulners CVELIST CVE-2026-97670 vulners.com
- Linux Security news on the vulnerability linuxsecurity.com
- OffSeq threat radar entry radar.offseq.com
- WordPress.org support forum thread on patch state wordpress.org
- Strix CVE-2026-97670 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:02.
Original description (NVD)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content: a verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wp_scheduled_delete action. Other non-deny-listed hooks extend the impact to denial of service (e.g. wp_maybe_auto_update) and, where vulnerable third-party handlers are installed, further privileged writes. The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read result is delivered only to the site owner and is not attacker-exfiltrable through the plugin's own email/response paths. Exploitation requires a published Avada form with AJAX submission and a notification whose email_message template includes an [all_fields] or explicit [field] placeholder - the default form configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.