Loading story…
A critical vulnerability in the Avada (Fusion) Builder WordPress plugin, tracked as CVE-2026-8713, allows unauthenticated attackers to delete arbitrary files on affected sites and potentially seize control of them. The flaw, rated CVSS 9.1, affects all versions through 3.15.3 and is caused by insufficient file path validation in the plugin’s maybe_delete_files() function, enabling path traversal through the wp_ajax_nopriv_fusion_form_submit_ajax handler. The issue is especially dangerous on sites with a published Avada form configured to save entries to the database, where a crafted submission can trigger immediate privacy cleanup and remove sensitive files such as wp-config.php.
Security researchers said deleting key WordPress files can force a site back into setup mode, creating a path to full site compromise and possible remote code execution. The bug was reported by researcher daroo through the Wordfence Bug Bounty Program, and ThemeFusion patched it in Avada Builder 3.15.4. The vulnerability impacts a plugin ecosystem used by roughly one million WordPress sites; while there is no confirmed evidence of widespread exploitation, defenders have been urged to update immediately, and Wordfence said its firewall can block exploit attempts by detecting path traversal sequences in submitted form data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researcher "daroo" reported a critical unauthenticated arbitrary file deletion vulnerability in the Avada (Fusion) Builder WordPress plugin through the Wordfence Bug Bounty Program, and the vendor acknowledged the issue. The flaw was later tracked as CVE-2026-8713 and affects versions up to and including 3.15.3.
ThemeFusion patched CVE-2026-8713 in Avada Builder version 3.15.4. The fix addressed insufficient file path validation that allowed unauthenticated attackers to use path traversal to delete arbitrary files on vulnerable sites.
Researcher "daroo" submitted the Avada Builder arbitrary file deletion vulnerability to the Wordfence Bug Bounty Program. According to the new reference, Wordfence received the report on May 13, 2026, before later notifying the vendor and public patch release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two vulnerabilities in the widely used **Avada Builder** WordPress plugin exposed more than 1 million sites to data theft risks, including an unauthenticated SQL injection flaw tracked as `CVE-2026-4798` and an authenticated arbitrary file read flaw tracked as `CVE-2026-4782`. Security researchers said the SQL injection issue could allow attackers to extract sensitive database contents, including credentials and password hashes, while the file read bug could let low-privileged users access sensitive files such as `wp-config.php`. The flaws were discovered by researcher **Rafie Muhammad** through the Wordfence Bug Bounty Program, and the vendor addressed the issues in **Avada Builder 3.15.3**. Reports said the vulnerabilities affected versions up to `3.15.2` and `3.15.1` respectively, with the SQL injection issue requiring a specific WooCommerce-related condition for exploitation. Administrators were urged to update immediately, review subscriber and other low-privilege accounts, and monitor for suspicious file access and unusual database activity on unpatched sites.
Jun 29, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026