CVE-2026-1509 is a code injection vulnerability in the Avada (Fusion) Builder plugin for WordPress. The issue arises because the output_action_hook() function accepts user-controlled input to trigger any registered WordPress action hook without proper authorization checks. Authenticated attackers with at least Subscriber-level privileges can exploit this to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation and other security impacts. The vulnerability affects all versions up to and including 3.15.1. There is no vendor advisory or patch currently available to address this issue.

An attacker with Subscriber-level access or higher can exploit this vulnerability to execute arbitrary WordPress action hooks. This can result in privilege escalation, unauthorized file inclusion, denial of service, or other impacts depending on the hooks present in the WordPress environment. The CVSS score of 5.4 reflects a medium severity impact primarily affecting confidentiality and integrity with no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to WordPress action hooks. Avoid granting Subscriber-level or higher access to untrusted users.