CVE-2026-65471

Name of the Vulnerable Software and Affected Versions Avada Core versions prior to 5.15.7

Description The Avada Core plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. This issue stems from missing or incorrect nonce validation—a unique token used to prevent forged requests—on a function. This allows unauthenticated attackers to execute unauthorized actions by tricking a site administrator into clicking a malicious link.

Recommendations Update Avada Core to version 5.15.7 or later.