CVE-2026-97670: Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification emailmessage [field] placeholder and the {actionhook,...} dynamic-data token; the 3.16.1 trust gate iscontentrequestsupplied() only inspects $POST['args']/$GET['args'], never the $POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content: a verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wpscheduleddelete action. Other non-deny-listed hooks extend the impact to denial of service (e.g. wpmaybeautoupdate) and, where vulnerable third-party handlers are installed, further privileged writes. The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read result is delivered only to the site owner and is not attacker-exfiltrable through the plugin's own email/response paths. Exploitation requires a published Avada form with AJAX submission and a notification whose emailmessage template includes an [allfields] or explicit [field] placeholder - the default form configuration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the public form-submit endpoint. No credentials or user interaction are required.
What conditions are required for exploitation?
The attacker needs to submit crafted form-field data that reaches the notification email_message field placeholder and uses the {action_hook,...} dynamic-data token. The affected authorization check does not inspect the formData parsed by this endpoint.
What can an attacker do?
An attacker can invoke arbitrary WordPress action hooks, including multiple hooks in one request. Verified impact includes permanently deleting trashed posts, pages, and comments; other hooks may cause denial of service or enable privileged writes through vulnerable third-party handlers.
Is sensitive data exposure also possible?
Yes. The unauthenticated dynamic-data pipeline also exposes a blind arbitrary read of user and post metadata, although the provided information does not specify the full scope of data that can be retrieved.
Which versions are affected?
All Avada (Fusion) Builder versions up to and including 7.16.1 are affected. The referenced vendor security update is version 7.16.2.