CVE-2026-97670: CWE-94 Improper Control of Generation of Code ('Code Injection') in themefusion Avada (Fusion) Builder

CVE-2026-97670 is an authorization bypass vulnerability in the Avada (Fusion) Builder WordPress plugin (versions up to and including 7.16.1). The plugin fails to properly verify authorization before dispatching WordPress action hooks whose names are derived from attacker-supplied form-field values. This occurs because the trust gate function only inspects certain request parameters and ignores the form data parsed by the public form-submit endpoint. As a result, unauthenticated attackers can invoke multiple arbitrary action hooks per request, causing state changes including permanent deletion of trashed posts, pages, and comments via the core wp_scheduled_delete action. Other hooks can cause denial of service or privileged writes if vulnerable third-party handlers exist. Additionally, the vulnerability exposes a blind arbitrary user/post-meta read, though the read data is only delivered to the site owner and not exfiltrable by the attacker. Exploitation requires a published Avada form with AJAX submission and an email notification template containing specific placeholders.

The vulnerability allows unauthenticated attackers to invoke arbitrary WordPress action hooks, leading to high-impact consequences such as permanent and irreversible deletion of site content (posts, pages, comments). It can also cause denial of service and potentially privileged writes if third-party handlers are vulnerable. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid using published Avada forms with AJAX submission that include notification email templates containing [all_fields] or explicit [field] placeholders. Review and restrict form configurations to prevent exposure of dynamic action hooks. Monitor vendor communications for updates and apply official fixes once released.