What is the CVSS score of CVE-2026-1509?

CVE-2026-1509 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1509

EUVD-2026-22820 MEDIUM

Code Injection (CWE-94)

2026-04-15 Wordfence

Denial Of Service RCE WordPress Privilege Escalation Code Injection

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:48 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 01:45 euvd

EUVD-2026-22820

Analysis Generated

Apr 15, 2026 - 01:45 vuln.today

CVE Published

Apr 15, 2026 - 01:25 nvd

MEDIUM 5.4

DescriptionCVE.org

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's output_action_hook() function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.

AnalysisAI

Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the output_action_hook() function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Avada (Fusion) Builder plugin provides dynamic data rendering capabilities within WordPress, allowing site administrators to configure content generation rules. The vulnerable output_action_hook() function accepts user-supplied input to dynamically invoke registered WordPress action hooks-a core WordPress feature that permits plugins and themes to execute custom code at predefined points. WordPress actions are typically triggered by internal code with the expectation that only trusted system components initiate them; however, this vulnerability exposes hook invocation to user-controlled data without verification of the caller's intent or authorization level. CWE-94 (Improper Control of Generation of Code) categorizes this as a code injection flaw where attacker-controlled parameters influence which code paths execute. The vulnerability requires PR:L (Subscriber-level authentication or higher), indicating it is not a pre-authentication attack but leverages WordPress's user role system.

RemediationAI

Update Avada (Fusion) Builder plugin to version 3.15.2 or later immediately. Site administrators should verify the update via the WordPress plugin dashboard or directly from https://avada.com/documentation/avada-changelog/ to confirm the patch version. Until patching is feasible, restrict Dynamic Data feature access to trusted users only by reviewing WordPress user role assignments and disabling Subscriber-level access if the feature is not required for those users. Additionally, audit active WordPress action hooks and consider disabling unnecessary plugins that expose sensitive actions. For detailed patch instructions and release notes, consult the official Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=cve.