The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. (CVE-2026-97670)

CVE-2026-97670 is an authorization bypass vulnerability in the Avada (Fusion) Builder WordPress plugin affecting all versions up to 7.16.1. The plugin fails to properly verify authorization before dispatching a WordPress action hook whose name is derived from attacker-controlled form-field values. The trust gate function only inspects certain request parameters but not the form data parsed by the public form-submit endpoint, enabling unauthenticated attackers to invoke multiple arbitrary WordPress action hooks per request. This can lead to permanent deletion of trashed posts, pages, and comments via the core wp_scheduled_delete action, denial of service through other hooks like wp_maybe_auto_update, and further privileged writes if third-party handlers are vulnerable. Additionally, a blind arbitrary user/post-meta read is exposed but the read data is only delivered to the site owner and not attacker-exfiltrable via the plugin's own channels. Exploitation requires a published Avada form with AJAX submission and a notification email_message template containing an [all_fields] or explicit [field] placeholder.

An unauthenticated attacker can bypass authorization controls to invoke arbitrary WordPress action hooks, causing high-impact consequences including permanent and irreversible deletion of site content such as trashed posts, pages, and comments. The vulnerability also enables denial of service conditions and potentially unauthorized privileged writes if vulnerable third-party handlers are installed. The blind arbitrary read of user/post-meta data does not expose information to the attacker directly. The CVSS 3.1 score of 9.1 reflects critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid using published Avada forms with AJAX submission that include notification email templates containing [all_fields] or explicit [field] placeholders. Monitor vendor communications for updates and apply official patches once released.