CVE-2026-8713 is a critical path traversal vulnerability (CWE-22) in the Avada (Fusion) Builder plugin for WordPress. The vulnerability arises from insufficient validation of file paths in the maybe_delete_files function, allowing unauthenticated attackers to delete arbitrary files on the server. The attack vector involves submitting a path traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while manipulating fusion_privacy_expiration_interval and privacy_expiration_action fields to force immediate deletion. This causes the Fusion_Form_DB_Privacy shutdown-hook to process and delete the planted entry without administrator interaction. This can lead to remote code execution if key files such as wp-config.php are deleted.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server hosting the WordPress site. This can disrupt website functionality and enable remote code execution by deleting critical files, such as wp-config.php. The vulnerability thus poses a high risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX handler if possible and monitor for suspicious activity related to form submissions. Avoid using vulnerable versions of the Avada (Fusion) Builder plugin and consider disabling or removing published forms configured to save entries to the database if not needed.