CVE-2026-1541: Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield() function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature's postcustomfield parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1541?
CVE-2026-1541 is classified as a high severity vulnerability due to its potential for sensitive information exposure.
How do I fix CVE-2026-1541?
To fix CVE-2026-1541, you should update the Avada (Fusion) Builder plugin to the latest version beyond 3.15.1.
What type of vulnerability is CVE-2026-1541?
CVE-2026-1541 is an Insecure Direct Object Reference vulnerability that leads to sensitive information exposure.
Who is affected by CVE-2026-1541?
All users of the Avada (Fusion) Builder plugin for WordPress with version 3.15.1 or lower are affected by CVE-2026-1541.
What impact does CVE-2026-1541 have on users?
CVE-2026-1541 allows authenticated users with Subscriber level or higher to access sensitive information they shouldn't be able to see.