EUVD-2026-22820Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's output_action_hook() function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.
AnalysisAI
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the output_action_hook() function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The Avada (Fusion) Builder plugin provides dynamic data rendering capabilities within WordPress, allowing site administrators to configure content generation rules. The vulnerable output_action_hook() function accepts user-supplied input to dynamically invoke registered WordPress action hooks-a core WordPress feature that permits plugins and themes to execute custom code at predefined points. WordPress actions are typically triggered by internal code with the expectation that only trusted system components initiate them; however, this vulnerability exposes hook invocation to user-controlled data without verification of the caller's intent or authorization level. CWE-94 (Improper Control of Generation of Code) categorizes this as a code injection flaw where attacker-controlled parameters influence which code paths execute. The vulnerability requires PR:L (Subscriber-level authentication or higher), indicating it is not a pre-authentication attack but leverages WordPress's user role system.
RemediationAI
Update Avada (Fusion) Builder plugin to version 3.15.2 or later immediately. Site administrators should verify the update via the WordPress plugin dashboard or directly from https://avada.com/documentation/avada-changelog/ to confirm the patch version. Until patching is feasible, restrict Dynamic Data feature access to trusted users only by reviewing WordPress user role assignments and disabling Subscriber-level access if the feature is not required for those users. Additionally, audit active WordPress action hooks and consider disabling unnecessary plugins that expose sensitive actions. For detailed patch instructions and release notes, consult the official Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=cve.
More in Avada Fusion Builder
View allArbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthentica
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the
Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and includin
Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive dat
Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subs
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated c
Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated a
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated co
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above t
Same weakness CWE-94 – Code Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today