Avada Builder Hook Injection Flaw Lets Attackers Wipe Site Content Without Login

The Avada Builder plugin for WordPress contains a critical authorization bypass vulnerability identified as CVE-2026-97670. This flaw allows unauthenticated attackers to execute arbitrary WordPress action hooks, leading to permanent data loss and potential denial of service.

What happened

The National Vulnerability Database recorded CVE-2026-97670 as a critical issue with a CVSS score of 9.1 for the Avada (Fusion) Builder plugin. The vulnerability exists in all versions of the plugin up to and including 7.16.1, according to the NVD record. The root cause is a failure to properly verify authorization before dispatching a WordPress action hook. The plugin derives the hook name from an attacker-supplied form field value, specifically via the notification email_message field placeholder and the {action_hook,...} dynamic-data token.

The plugin’s trust gate function, is_content_request_supplied(), only inspects $_POST['args'] and $_GET['args'] in version 3.16.1 logic. It fails to inspect $_POST['formData'], which the public form-submit endpoint parses, according to the vulnerability description. This oversight allows unauthenticated attackers to invoke arbitrary WordPress action hooks multiple times per request. Researchers verified that an unauthenticated request can permanently delete trashed posts, pages, and comments by invoking the core wp_scheduled_delete action.

Other non-deny-listed hooks extend the impact to denial of service scenarios, such as triggering wp_maybe_auto_update. If vulnerable third-party handlers are installed on the site, attackers can perform further privileged writes. The same unauthenticated dynamic-data pipeline also exposes a blind arbitrary user and post-meta read capability. The results of these reads are delivered only to the site owner and are not exfiltrable by the attacker through the plugin’s own email or response paths.

Why it matters

Exploitation requires a published Avada form with AJAX submission and a notification template that includes an [all_fields] or explicit [field] placeholder. This configuration is the default setting for Avada forms, making most installations vulnerable by default. The ability to permanently delete site content without authentication poses a severe risk to business continuity and data integrity. Organizations relying on WordPress for content management face immediate operational risks if they run affected versions.

The vulnerability is classified under CWE-94, which relates to code injection issues. The combination of arbitrary hook execution and blind data reading creates a complex threat vector for attackers. While direct data exfiltration is limited, the potential for state changes and service disruption is high. Business leaders must recognize that default configurations expose their sites to this specific attack vector.

What to watch

• Monitor for unusual spikes in server resource usage that may indicate denial of service attempts.
• Review logs for unauthorized invocations of core WordPress actions like wp_scheduled_delete.
• Check for missing or deleted content, particularly items that were previously in the trash.
• Assess the presence of third-party plugins that add custom action hooks to the site.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Avada Builder

• Identify all WordPress sites using the Avada Builder plugin and verify their current version numbers.
• Audit form configurations to check if default notification templates with field placeholders are active.
• Restrict access to form submission endpoints using web application firewalls or rate limiting.
• Prepare an incident response plan for potential content loss once the vendor provides an update.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Avada Builder are affected by CVE-2026-97670?

All versions of the Avada (Fusion) Builder plugin up to and including 7.16.1 are vulnerable to this authorization bypass.

Can attackers steal data directly from the site using this flaw?

No, the vulnerability allows blind reads that deliver results only to the site owner, not to the attacker directly.

Is there a patch available for this vulnerability?

No fix has been confirmed yet in the provided source material for versions up to 7.16.1.