Avada Builder Auth Flaw Lets Unauthenticated Users Permanently Delete Posts and Pages
CVE-2026-97670 allows unauthenticated users to execute arbitrary WordPress action hooks via form submissions, potentially destroying site content permanently.
Key points
- The vulnerability affects Avada Builder versions up to and including 7.16.1.
- Attackers can permanently delete trashed posts, pages, and comments without authentication.
- The flaw stems from improper verification of authorization before dispatching action hooks.
The Avada (Fusion) Builder plugin for WordPress contains a critical authorization bypass vulnerability, identified as CVE-2026-97670. This flaw allows unauthenticated attackers to invoke arbitrary WordPress action hooks by exploiting improper input validation in the plugin’s notification system. The issue affects all versions of the plugin up to and including version 7.16.1, according to the National Vulnerability Database.
Root cause
The vulnerability arises because the plugin fails to properly verify authorization before dispatching a WordPress action hook. The hook name is derived from an attacker-supplied form-field value via the notification email_message field placeholder and the {action_hook,...} dynamic-data token. The trust gate function is_content_request_supplied() only inspects specific POST and GET arguments, ignoring the formData parsed by the public form-submit endpoint.
Attack path
Unauthenticated attackers can exploit this flaw by submitting forms that trigger arbitrary WordPress action hooks. This can lead to permanent, irreversible destruction of site content, such as the deletion of trashed posts, pages, and comments via the wp_scheduled_delete action. The attack also allows for denial of service through hooks like wp_maybe_auto_update. Additionally, the pipeline exposes a blind arbitrary user or post-meta read, though data is only delivered to the site owner.
Affected versions
- Avada (Fusion) Builder versions up to 7.16.1 are vulnerable.
- The vulnerability requires a published Avada form with AJAX submission.
- Default form configurations with specific email placeholders are susceptible.
Mitigation
- Review and restrict access to Avada forms with AJAX submission capabilities.
- Audit notification email templates to remove dangerous dynamic-data tokens.
- Monitor server logs for unusual activity related to form submissions.
- Ensure WordPress core and all plugins are updated to the latest secure versions.
What to do and how to stay safe: Avada Builder
- Audit all public-facing forms for unnecessary dynamic data tokens in notification settings.
- Restrict AJAX form submissions to authenticated users where possible.
- Monitor server logs for repeated or unusual hook execution attempts.
- Implement web application firewalls to filter suspicious form data patterns.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-97670?
CVE-2026-97670 is a critical authorization bypass vulnerability in the Avada Builder plugin for WordPress that allows unauthenticated attackers to trigger arbitrary action hooks.
Which versions of Avada Builder are affected?
All versions of the Avada (Fusion) Builder plugin up to and including version 7.16.1 are affected by this vulnerability.
Can attackers steal data through this vulnerability?
Attackers can perform blind reads of user or post metadata, but the results are only sent to the site owner and cannot be directly exfiltrated by the attacker.
