CVE Intelligence
Analysis AI-assisted

CVE-2026-8713: Avada (Fusion) Builder WordPress Plugin - Arbitrary File Deletion via Path Traversal

The Avada (Fusion) Builder plugin for WordPress contains an arbitrary file deletion flaw caused by insufficient file path validation in all versions up to and including 3.15.3. The record lists a critical severity with a CVSS score of 9.1 from Wordfence and classifies the weakness as path traversal (CWE-22). No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an arbitrary file deletion vulnerability in the Avada (Fusion) Builder plugin for WordPress. The weakness is in the maybe_delete_files function, which the record says does not validate file paths sufficiently in versions up to and including 3.15.3. The record associates the issue with path traversal (CWE-22).

Impact

  • The record states that an unauthenticated attacker may be able to delete arbitrary files on the server.
  • The record states that deleting certain files, such as wp-config.php, can easily lead to remote code execution.
  • Wordfence rates the issue with a CVSS score of 9.1 and the record lists the severity as critical. The score vector in the record indicates high impact to integrity and availability and no confidentiality impact.
  • Inference: loss of configuration or core files could also cause site outages even where code execution is not achieved.

Affected products and versions

  • Product: Avada (Fusion) Builder plugin for WordPress.
  • The record states that all versions up to and including 3.15.3 are affected.
  • The structured affected and fixes lists in the record are empty, so the sources consulted do not provide a confirmed fixed version.

Exploitation status

  • The CISA KEV catalog entry in the record is not listed.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record describes conditions that must exist for the flaw to be reached, including a published form configured to save entries to the database. Organizations should not assume these conditions are absent.

Remediation and mitigation

  • Identify all WordPress sites running the Avada (Fusion) Builder plugin and record installed versions.
  • Treat any installation at version 3.15.3 or earlier as affected, and check the vendor or plugin repository for a release that supersedes it. The record does not name a fixed version.
  • Where updating is not immediately possible, reduce exposure by limiting or disabling public forms that store entries in the database, following the vendor guidance.
  • Maintain verified backups of the site, database and configuration files so that any damage can be recovered.
  • Restrict file system permissions for the web server user to the minimum required, and keep sensitive configuration files protected.

Detection guidance

  • Review web server and application logs for unusual requests to the Fusion form submission AJAX handler, especially requests from unauthenticated sources containing unexpected path characters.
  • Monitor for unexpected disappearance or modification of core WordPress files, including wp-config.php, and alert on changes.
  • Check integrity of plugin files and compare them with a known good copy from the official source.
  • Use file integrity monitoring where available to detect deletions outside normal maintenance windows.

Limitations of the available information

  • The record does not list affected or fixed version ranges beyond the statement that versions up to and including 3.15.3 are affected.
  • No EPSS score, SSVC decision or KEV exploitation data is available in the record.
  • The record contains references to a Wordfence threat intelligence entry and a plugin repository source line, but the content of those pages was not provided for this analysis.
  • The record's source status is Deferred, so the information may change as the CVE is processed.

Frequently asked questions

What is the vulnerability in CVE-2026-8713?

The record describes arbitrary file deletion in the Avada (Fusion) Builder WordPress plugin caused by insufficient file path validation. It is classified as path traversal (CWE-22).

Which versions are affected?

The record states that all versions up to and including 3.15.3 are affected. The record does not provide a confirmed fixed version.

Is this vulnerability being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Identify affected installations, check the vendor for an updated release, consider limiting public forms that store database entries, and keep verified backups and file integrity monitoring in place.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.