CVE-2026-8713 is a critical path traversal vulnerability (CWE-22) in the Avada (Fusion) Builder WordPress plugin affecting all versions up to and including 3.15.3. The vulnerability arises from insufficient validation in the maybe_delete_files function, allowing unauthenticated attackers to delete arbitrary files by submitting a specially crafted payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler. Attackers control specific form fields to force immediate deletion of planted entries, which are processed by the Fusion_Form_DB_Privacy shutdown-hook without administrator interaction. This can lead to remote code execution if critical files like wp-config.php are deleted.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server hosting the WordPress site. This can disrupt site functionality and may lead to remote code execution if key files are deleted. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX handler if possible and monitor for suspicious form submissions. Avoid using vulnerable versions of the Avada (Fusion) Builder plugin and consider disabling or limiting the use of forms configured to save entries to the database.