Avada Users at Risk: Unauthenticated Attackers Can Delete Site Content via Critical Builder Flaw Up to 7.16.1

Organisations running the Avada Builder plugin for WordPress face immediate risk of site destruction due to a critical authorisation bypass. The flaw, tracked as CVE-2026-97670, allows unauthenticated attackers to execute arbitrary code and delete content permanently. This vulnerability exists in all versions of the plugin up to, and including, 7.16.1, exposing a large number of sites to potential data loss.

How does the authorisation bypass work technically?

The issue stems from the plugin failing to verify authorisation before dispatching a WordPress action hook. The hook name is derived from an attacker-supplied form-field value, processed via the notification email_message field placeholder and the {action_hook,...} dynamic-data token. According to the National Vulnerability Database record, the trust gate function is_content_request_supplied() only inspects $_POST['args'] or $_GET['args'], ignoring the $_POST['formData'] that the public form-submit endpoint parses.

This oversight allows attackers to bypass security checks entirely. By manipulating the form data, an attacker can specify any valid WordPress action hook. The plugin then executes this hook with elevated privileges, leading to state changes on the site. The weakness is classified as CWE-94, indicating improper control of generation of code, which enables the execution of unintended commands through the dynamic data pipeline.

What is the potential impact on affected sites?

The consequences of exploiting CVE-2026-97670 are severe and often irreversible. A verified unauthenticated request can permanently delete trashed posts, pages, and comments by invoking the core wp_scheduled_delete action. This results in immediate data loss that cannot be recovered from the trash bin. Other non-deny-listed hooks can extend the impact to denial of service, such as triggering wp_maybe_auto_update, which consumes server resources.

Furthermore, if vulnerable third-party handlers are installed, the exploit can lead to further privileged writes. The same unauthenticated dynamic-data pipeline also exposes a blind arbitrary user or post-meta read. While the read result is delivered only to the site owner and not exfiltrable through the plugin’s own email or response paths, it still represents a significant information disclosure risk for sensitive metadata stored in the database.

Which configurations are vulnerable to this attack?

Exploitation requires specific conditions to be met on the target WordPress site. The site must have a published Avada form configured with AJAX submission. Additionally, the form’s notification settings must include an email_message template that contains an [all_fields] or explicit [field] placeholder. According to the source material, this is the default form configuration for Avada Builder, meaning most installations are likely vulnerable by default.

The vulnerability affects the Avada (Fusion) Builder plugin developed by Themefusion. All versions up to 7.16.1 are affected, as the authorisation check was not properly implemented in these releases. The widespread use of default configurations increases the attack surface, allowing automated scanners or manual attackers to identify and exploit vulnerable forms without prior authentication or complex reconnaissance.

Is there a fix available for CVE-2026-97670?

No patch or update has been confirmed yet for this critical vulnerability. Administrators should not assume that a fix is imminent or that existing security plugins will mitigate the issue. The absence of a vendor-provided update means that sites running Avada Builder up to version 7.16.1 remain exposed to unauthenticated attacks. Until a secure version is released, the primary mitigation is to reduce the attack surface by modifying form configurations.

What to do and how to stay safe: Avada Builder

• Audit all Avada forms on your WordPress sites to identify those using AJAX submission and default notification templates.
• Modify email_message templates to remove [all_fields] or explicit [field] placeholders if they are not strictly necessary for business operations.
• Monitor server logs for unusual spikes in form submissions or requests targeting the form-submit endpoint, which may indicate exploitation attempts.
• Review installed third-party plugins for potential hook handlers that could be abused if this vulnerability is exploited, and consider disabling unnecessary ones.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-97670?

The vulnerability has a CVSS score of 9.1, which is rated as Critical.

Can attackers steal data directly from this exploit?

No, the blind read result is delivered to the site owner, not the attacker, though metadata is exposed.

Which versions of Avada Builder are affected?

All versions up to and including 7.16.1 are vulnerable to this authorisation bypass.