Loading story…
A critical unauthenticated arbitrary file deletion vulnerability, tracked as CVE-2026-8713, was disclosed in the Avada (Fusion) Builder plugin for WordPress. The flaw affects versions through 3.15.3 and stems from insufficient validation of the file_path parameter in the maybe_delete_files() function within the Fusion_Form_DB_Entries class, enabling directory traversal and deletion of arbitrary files on the server.
Researchers warned that attackers could delete sensitive files such as wp-config.php, potentially forcing a WordPress site into a reinstallation state and allowing an adversary to seize administrative control and possibly achieve remote code execution. Wordfence reported that a patch has been released, and the security community has already published a Nuclei detection template to help defenders identify exposed installations and prioritize remediation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A pull request was opened in the ProjectDiscovery nuclei-templates repository to add detection coverage for CVE-2026-8713, the Avada Builder arbitrary file deletion vulnerability. The template references NVD, Wordfence, and Falcon Internet for the vulnerability details.
Wordfence reported that a critical unauthenticated arbitrary file deletion vulnerability affecting the Avada (Fusion) Builder WordPress plugin was patched. The issue affects versions up to 3.15.3 and could allow deletion of files such as wp-config.php, potentially enabling site takeover and remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the **Avada (Fusion) Builder** WordPress plugin, tracked as `CVE-2026-8713`, allows unauthenticated attackers to delete arbitrary files on affected sites and potentially seize control of them. The flaw, rated **CVSS 9.1**, affects all versions through **3.15.3** and is caused by insufficient file path validation in the plugin’s `maybe_delete_files()` function, enabling path traversal through the `wp_ajax_nopriv_fusion_form_submit_ajax` handler. The issue is especially dangerous on sites with a published Avada form configured to save entries to the database, where a crafted submission can trigger immediate privacy cleanup and remove sensitive files such as `wp-config.php`. Security researchers said deleting key WordPress files can force a site back into setup mode, creating a path to **full site compromise** and possible **remote code execution**. The bug was reported by researcher **daroo** through the Wordfence Bug Bounty Program, and ThemeFusion patched it in **Avada Builder 3.15.4**. The vulnerability impacts a plugin ecosystem used by roughly **one million WordPress sites**; while there is no confirmed evidence of widespread exploitation, defenders have been urged to update immediately, and Wordfence said its firewall can block exploit attempts by detecting path traversal sequences in submitted form data.
Jun 29, 2026
Two vulnerabilities in the widely used **Avada Builder** WordPress plugin exposed more than 1 million sites to data theft risks, including an unauthenticated SQL injection flaw tracked as `CVE-2026-4798` and an authenticated arbitrary file read flaw tracked as `CVE-2026-4782`. Security researchers said the SQL injection issue could allow attackers to extract sensitive database contents, including credentials and password hashes, while the file read bug could let low-privileged users access sensitive files such as `wp-config.php`. The flaws were discovered by researcher **Rafie Muhammad** through the Wordfence Bug Bounty Program, and the vendor addressed the issues in **Avada Builder 3.15.3**. Reports said the vulnerabilities affected versions up to `3.15.2` and `3.15.1` respectively, with the SQL injection issue requiring a specific WooCommerce-related condition for exploitation. Administrators were urged to update immediately, review subscriber and other low-privilege accounts, and monitor for suspicious file access and unusual database activity on unpatched sites.
Jun 29, 2026
A critical unauthenticated remote-code-execution vulnerability, **CVE-2026-18431** (CVSS 9.8), affects the Avada WordPress theme through version 7.16 when its bundled Fusion Builder plugin through version 3.16 is installed and active. The six-stage exploit chain combines authorization, trust-boundary, input-validation, and file-handling flaws, enabling remote attackers to write and execute arbitrary PHP files and potentially take full control of vulnerable WordPress sites; exploitation also requires certain administrator-authored content. ThemeFusion released fixes in **Avada 7.16.1** and **Fusion Builder 3.16.1**. Wordfence reported that its Argus agent discovered and reproduced the chain and produced a proof of concept, which Wordfence validated in an isolated environment; firewall protection was made available to paid customers before the public disclosure and was scheduled for free users. No public exploit or CISA Known Exploited Vulnerabilities listing had been reported at publication.
Aug 28, 2026