CVE-2026-121759: Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR

Q: Who can exploit this issue?

An authenticated WordPress user with at least the Contributor role can exploit it. The affected plugin does not verify that the user owns the post or page they attempt to move to the trash.

Q: What content can an attacker affect?

A Contributor-level user can trash arbitrary posts and pages, including content they do not own. If the WordPress trash feature is disabled, the affected content can instead be permanently deleted.

Q: Are sites without Contributor accounts exposed?

The described attack requires an authenticated account with a role as low as Contributor. The provided information does not indicate that unauthenticated attackers can exploit it.

Q: What should be prioritized if the plugin cannot be updated immediately?

Restrict or review Contributor and higher accounts, particularly untrusted accounts, because those roles can perform the described action. Enable or retain the trash feature where possible to reduce the risk of permanent deletion.

Published Nov 9, 2026

Updated

The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.

Affected Software

1 affected component

ThemeFusion Fusion Page Builder<1.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fusion Page Builder to a version that resolves this vulnerability.
Fixed in 1.7.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with at least the Contributor role can exploit it. The affected plugin does not verify that the user owns the post or page they attempt to move to the trash.

What content can an attacker affect?

A Contributor-level user can trash arbitrary posts and pages, including content they do not own. If the WordPress trash feature is disabled, the affected content can instead be permanently deleted.

Are sites without Contributor accounts exposed?

The described attack requires an authenticated account with a role as low as Contributor. The provided information does not indicate that unauthenticated attackers can exploit it.

What should be prioritized if the plugin cannot be updated immediately?

Restrict or review Contributor and higher accounts, particularly untrusted accounts, because those roles can perform the described action. Enable or retain the trash feature where possible to reduce the risk of permanent deletion.

CVE-2026-121759: Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What content can an attacker affect?

Are sites without Contributor accounts exposed?

What should be prioritized if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content can an attacker affect?

Are sites without Contributor accounts exposed?

What should be prioritized if the plugin cannot be updated immediately?