CVE-2026-8713 Details
Description
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.
A vulnerability in the Avada (Fusion) Builder plugin for WordPress, present in all versions through 3.15.3, allows for arbitrary file deletion. This issue arises from inadequate file path validation in the 'maybe_delete_files' function. The vulnerability enables unauthenticated attackers to delete any file on the server, potentially leading to remote code execution if a critical file, such as 'wp-config.php', is removed. Exploitation requires a published Avada form set to save entries in the database. An attacker can submit a path-traversal payload through the 'wp_ajax_nopriv_fusion_form_submit_ajax' handler, manipulating the 'fusion_privacy_expiration_interval' and 'privacy_expiration_action' fields to trigger an immediate deletion. This process causes the entry to be processed by the 'Fusion_Form_DB_Privacy' shutdown-hook routine without any administrator involvement.
Users are advised to update the Avada (Fusion) Builder plugin to version 3.15.4 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Avada Fusion Builder | <= 3.15.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |