Avada Builder Critical Bypass Lets Attackers Destroy WordPress Sites

The Avada (Fusion) Builder plugin for WordPress contains a critical authorization bypass vulnerability, identified as CVE-2026-97670, according to the National Vulnerability Database. The flaw affects all versions of the plugin up to and including 7.16.1. Security researchers have assigned the issue a CVSS score of 9.1, classifying it as critical. This weakness allows unauthenticated attackers to execute arbitrary WordPress action hooks, potentially leading to irreversible site damage.

How does the authorization bypass work?

The vulnerability stems from the plugin failing to properly verify authorization before dispatching a WordPress action hook, according to the NVD record. The hook name is derived from an attacker-supplied form field value. Specifically, the exploit uses the notification email_message field placeholder and the {action_hook,...} dynamic-data token. The plugin’s trust gate, is_content_request_supplied(), only inspects $_POST['args'] and $_GET['args']. It fails to inspect $_POST['formData'], which the public form-submit endpoint parses.

What damage can an attacker cause?

Unauthenticated attackers can invoke arbitrary WordPress action hooks multiple times per request, causing significant state changes, according to the source material. A verified request permanently deleted trashed posts, pages, and comments by triggering the core wp_scheduled_delete action. Other non-deny-listed hooks can cause denial of service, such as wp_maybe_auto_update. If vulnerable third-party handlers are installed, attackers may achieve further privileged writes. The default form configuration often includes the necessary placeholders for exploitation.

Are there data exfiltration risks?

The same unauthenticated dynamic-data pipeline exposes a blind arbitrary user and post-meta read capability, according to the NVD description. However, the read results are delivered only to the site owner. The data is not exfiltrable by the attacker through the plugin’s own email or response paths. This limitation restricts the immediate data theft potential, though the operational impact on site integrity remains severe. Exploitation requires a published Avada form with AJAX submission and specific notification templates.

What is the current patch status?

No fix or update has been confirmed in the source material for versions up to 7.16.1. The vulnerability remains active in all versions up to and including 7.16.1. Organizations using the Avada Builder plugin should assess their exposure immediately. The default configuration of Avada forms often includes the [all_fields] or explicit [field] placeholders required for exploitation. Until a vendor patch is released, the risk of unauthenticated site destruction persists.

What to do and how to stay safe: Avada Builder

• Audit all WordPress sites for the Avada Builder plugin and check if versions are 7.16.1 or older.
• Review published Avada forms to see if they use AJAX submission and notification email_message templates.
• Disable public form submissions or remove the plugin if business operations allow, to reduce attack surface.
• Monitor server logs for unusual activity related to wp_scheduled_delete or other core action hooks.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Avada Builder are affected by CVE-2026-97670?

All versions of the Avada (Fusion) Builder plugin up to and including 7.16.1 are vulnerable to this authorization bypass.

Can an attacker steal user data through this vulnerability?

The vulnerability allows blind reads of user and post meta, but results are sent only to the site owner, not the attacker.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-97670 as Critical with a CVSS score of 9.1.