CVE-2026-97471: Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[linktarget]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wpuserlevel, and WooCommerce customer PII such as billingemail, billingphone, and billingaddress1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusioninstagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using Avada (Fusion) Builder version 3.16.1 or earlier are affected. An unauthenticated remote attacker can exploit the issue, and pages that render the [fusion_instagram] shortcode expose the nonce needed for the attack to anonymous visitors.
What information could be disclosed?
An attacker can extract arbitrary user meta values for any user ID. Examples include administrator email addresses, login names, wp_user_level, and WooCommerce customer data such as billing email addresses, phone numbers, and billing addresses.
Does exploitation require an account or user interaction?
No. The reported vector is network-accessible, requires no privileges and no user interaction; the required awb-instagram-nonce can be harvested from fusionInstagramVars on a page rendering the [fusion_instagram] shortcode.
How can I assess whether my site is likely exposed?
Check whether the site runs Avada (Fusion) Builder 3.16.1 or earlier and whether any publicly accessible page renders the [fusion_instagram] shortcode. Such pages print the required nonce in plaintext, enabling anonymous visitors to obtain it before sending an exploit request.