CVE-2026-1541

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder versions prior to 3.15.2

Description The plugin contains a sensitive information exposure issue. The fusion get post custom field() function does not validate if metadata keys are protected by an underscore prefix. This allows authenticated attackers with Subscriber-level access or higher to extract protected post metadata fields through the post custom field parameter of the Dynamic Data feature.

Recommendations Update to a version newer than 3.15.1.