Loading vulnerability…
Unauthenticated action-hook invocation in Avada Fusion Builder
CVE-2026-97670 is an authorization-bypass vulnerability in the Avada (Fusion) Builder plugin for WordPress. Notification processing evaluates attacker-controlled form-field values through field placeholders and the action_hook dynamic-data token, allowing unauthenticated visitors to dispatch existing WordPress action hooks without authorization checks. The is_content_request_supplied() trust gate checks request arguments but not the formData input parsed by the public submission endpoint. Multiple hooks can be invoked in one request. Affected-version information is inconsistent: Fusion Builder versions through 3.16.1 and Avada Builder versions through 7.16.1 are both identified. Exploitation can cause destructive state changes and denial of service; it does not establish execution of arbitrary attacker-supplied PHP.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Verified exploitation permanently deleted trashed posts, pages, and comments already eligible for deletion under WordPress retention rules. Deletion of live content or premature deletion of newly trashed items was not demonstrated. Other callable hooks can cause denial of service, while vulnerable third-party handlers may permit additional privileged writes. The same processing pipeline supports blind arbitrary user/post metadata reads, but results are delivered only to the site owner and cannot be exfiltrated through the plugin's own email or response paths.
If you can’t patch tonight, do this now.
Review publicly reachable AJAX forms and their notification templates for submitted-field placeholders. Remove or sanitize user-controlled input in notification templates to reduce exposure, and review configurations for sensitive actions. Review available logs for unexpected deletion activity. These measures do not replace installing the fixed plugin release.
Patch, then assume compromise.
Install the security update for the active Builder plugin. Fusion Builder 3.16.2 is identified as fixed, while conflicting version information recommends Avada Builder 7.16.2 or later; verify the applicable plugin release rather than relying on the Avada theme version or completion of a server update. The plugin update path is Avada > Plugins / Add-ons. After updating, test important forms and confirm notification delivery.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.