Critical File Deletion Flaw in Avada Builder Could Lead to WordPress Site Takeover

A critical unauthenticated arbitrary file deletion vulnerability, tracked as CVE-2026-8713, was disclosed in the Avada (Fusion) Builder plugin for WordPress. The flaw affects versions through 3.15.3 and stems from insufficient validation of the file_path parameter in the maybe_delete_files() function within the Fusion_Form_DB_Entries class, enabling directory traversal and deletion of arbitrary files on the server.

Researchers warned that attackers could delete sensitive files such as wp-config.php, potentially forcing a WordPress site into a reinstallation state and allowing an adversary to seize administrative control and possibly achieve remote code execution. Wordfence reported that a patch has been released, and the security community has already published a Nuclei detection template to help defenders identify exposed installations and prioritize remediation.