CVE-2026-97670

9.1 CRITICAL

Published 2026-10-10 · Updated 2026-10-13

AI risk analysis

Summary: The Avada plugin has an authorization bypass vulnerability that allows unauthenticated attackers to invoke arbitrary WordPress action hooks, leading to permanent site destruction including deletion of posts, pages, and comments via wp_scheduled_delete, plus potential denial of service and privilege escalation through third-party integrations.
Exploitability: Exploitation requires a published Avada form with AJAX submission and notification enabled, but is otherwise straightforward once the prerequisites are met.
Blast radius: The vulnerability affects all versions up to 7.16.1 and can lead to complete site compromise including irreversible content deletion and potential denial of service across the entire WordPress installation.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Avada version 7.16.2 or later to remediate this authorization bypass vulnerability.

auth-bypasswp-action-hookwordpresscontent-deletiondenial-of-service

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content: a verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wp_scheduled_delete action. Other non-deny-listed hooks extend the impact to denial of service (e.g. wp_maybe_auto_update) and, where vulnerable third-party handlers are installed, further privileged writes. The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read result is delivered only to the site owner and is not attacker-exfiltrable through the plugin's own email/response paths. Exploitation requires a published Avada form with AJAX submission and a notification whose email_message template includes an [all_fields] or explicit [field] placeholder - the default form configuration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-94

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.