Unauthenticated Arbitrary File Deletion in Avada (Fusion) Builder <= 3.15.3

CVE-2026-8713 is a critical arbitrary file deletion vulnerability in the Avada (Fusion) Builder plugin for WordPress affecting all versions up to and including 3.15.3. The flaw is caused by insufficient file path validation in the maybe_delete_files() function, reported as part of the Fusion form handling code path. The vulnerable logic converts a user-influenced upload URL into a local filesystem path and deletes the resulting file without performing adequate canonicalization or containment checks, allowing path traversal sequences to escape the intended upload directory. Exploitation is possible through the unauthenticated wp_ajax_nopriv_fusion_form_submit_ajax handler when a target site exposes a published Avada form configured to save entries to the database. An attacker can submit a crafted form entry containing a traversal payload and manipulate the fusion_privacy_expiration_interval and privacy_expiration_action fields to force immediate cleanup. The malicious entry is then automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine, resulting in deletion of attacker-selected files on the server without administrator interaction.