Avada Builder Arbitrary Hook Vuln Risks Permanent Content Loss via CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress contains a critical authorization bypass vulnerability in all versions up to and including 7.16.1. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to invoke arbitrary WordPress action hooks by manipulating form field values in published Avada forms.

The risk

The vulnerability stems from the plugin failing to properly verify authorization before dispatching a WordPress action hook. Attackers supply the hook name via the notification email_message field placeholder and the dynamic-data token. The existing trust gate in version 3.16.1 only inspects specific POST and GET arguments, ignoring the formData parsed by the public form-submit endpoint.

This oversight enables unauthenticated users to trigger multiple action hooks per request. Researchers verified that an unauthenticated request can permanently delete trashed posts, pages, and comments using the core wp_scheduled_delete action. This results in irreversible destruction of site content for affected WordPress installations.

Beyond content deletion, other non-deny-listed hooks can cause denial of service conditions. For example, invoking wp_maybe_auto_update can disrupt site availability. If vulnerable third-party handlers are installed, the impact extends to further privileged writes on the server.

The same unauthenticated dynamic-data pipeline also exposes a blind arbitrary user and post-meta read capability. While the read result is delivered only to the site owner and cannot be exfiltrated through the plugin's email or response paths, it represents a significant privacy and data exposure risk for business owners.

Who is exposed

Exploitation requires a published Avada form with AJAX submission enabled. The form notification email_message template must include an [all_fields] or explicit [field] placeholder. According to the source material, this configuration is the default form setting, meaning most installations using standard Avada forms are immediately exposed without additional configuration changes.

Cost and compliance

The National Vulnerability Database assigns CVE-2026-97670 a CVSS score of 9.1, classifying the severity as Critical. The weakness is categorized under CWE-94, which relates to code injection flaws. No specific compliance mandates or financial penalties are detailed in the available records, but the potential for data loss and service disruption poses operational risks.

What to watch

Business leaders should verify if their WordPress sites use the Avada Builder plugin with default form settings. Monitor for unusual server resource consumption or unexpected deletion of trashed content, which may indicate exploitation. Check for any third-party plugins that might register vulnerable handlers for the triggered hooks.

What to do and how to stay safe: Avada Builder

• Audit all WordPress sites to identify if Avada Builder versions up to 7.16.1 are installed and actively used.
• Review Avada form configurations to ensure AJAX submission is disabled or notification templates do not use dynamic field placeholders until a fix is available.
• Implement strict monitoring for unauthorized actions on trashed content and server resource spikes indicative of hook abuse.
• Prepare incident response plans for potential data loss or denial of service events triggered by unauthenticated requests.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Avada Builder are affected by this vulnerability?

All versions of the Avada (Fusion) Builder plugin up to and including 7.16.1 are vulnerable to this authorization bypass.

Can attackers steal data directly from the site using this flaw?

Attackers cannot exfiltrate data through the plugin's email or response paths, but they can trigger blind reads of user and post metadata delivered to the site owner.

Is there a patch available for CVE-2026-97670?

No fix has been confirmed yet in the provided source material; users should monitor vendor announcements for an update.