CVE-2026-97471: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in themefusion Avada (Fusion) Builder

CVE-2026-97471 is a CWE-200 sensitive information exposure vulnerability in the Avada (Fusion) Builder WordPress plugin affecting all versions up to and including 3.16.1. The flaw arises from the 'args[link_target]' parameter, which can be manipulated by unauthenticated attackers to extract arbitrary user meta values such as administrator email addresses, login names, wp_user_level, and WooCommerce customer personally identifiable information (PII) like billing email, phone, and address. The required 'awb-instagram-nonce' token to trigger the vulnerable endpoint is exposed in plaintext within the fusionInstagramVars JavaScript variable on any page rendering the [fusion_instagram] shortcode, making it easily harvestable by anonymous users prior to exploitation.

An unauthenticated attacker can obtain sensitive user information including administrator contact details, login names, user privilege levels, and customer PII from WooCommerce stores. This exposure could facilitate further targeted attacks or privacy violations. The vulnerability does not allow modification or denial of service but compromises confidentiality of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the [fusion_instagram] shortcode on public-facing pages or restrict access to pages exposing the 'awb-instagram-nonce' token. Monitor vendor channels for updates and apply patches promptly once released.