CVE-2026-97670

Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.2 Fusion Builder versions prior to 3.16.2

Description An authorization bypass exists due to improper verification before dispatching a WordPress action hook. The issue occurs when the hook name is derived from an attacker-supplied form-field value via the notification email message [field] placeholder and the {action hook,...} dynamic-data token. This allows unauthenticated attackers to invoke arbitrary WordPress action hooks, which can lead to permanent destruction of site content, such as the deletion of trashed posts, pages, and comments through the wp scheduled delete action. Additionally, it can cause denial of service via wp maybe auto update or enable privileged writes if vulnerable third-party handlers are present. The same pipeline allows for a blind arbitrary user or post-meta read, although the result is only delivered to the site owner. Exploitation requires a published Avada form with AJAX submission and a notification template containing an [all fields] or explicit [field] placeholder.

Recommendations Update Avada to version 7.16.2 or later. Update Fusion Builder to version 3.16.2 or later.