Avada Fusion Builder CVE-2026-1509

CVSS 5.4 (Medium) with low attack complexity (AC:L) and network-based delivery (AV:N) provides a baseline severity assessment; however, real-world risk depends heavily on installed WordPress hooks and plugins. The CVSS impact metrics (C:L, I:L, A:N) indicate partial confidentiality and integrity compromise, but the vulnerability description explicitly notes potential for privilege escalation, remote code execution, and denial of service-all higher-impact outcomes not fully captured in the CVSS base score. This gap between CVSS and described impact reflects that the actual risk is context-dependent: a WordPress installation with numerous action hooks (especially those handling file operations, user capability modification, or plugin execution) faces substantially higher risk than a minimal setup. Authentication requirement (PR:L) significantly reduces attack surface compared to unauthenticated vulnerabilities, limiting abuse to users with at least Subscriber role. No public proof-of-concept, EPSS score, or KEV (CISA Known Exploited Vulnerabilities) confirmation has been provided, suggesting limited visibility into real-world exploitation at time of analysis. Given the moderate CVSS, authentication gate, and absence of confirmed exploitation data, this should be prioritized based on WordPress ecosystem sensitivity and the breadth of installed hooks-organizations with plugin-heavy WordPress environments should treat this as higher priority than base CVSS suggests.

A WordPress site with Subscriber-level user accounts (e.g., content contributors with limited permissions) or lower-privileged administrator accounts is vulnerable if they gain access to the Avada Dynamic Data configuration interface. An attacker with a compromised Subscriber account could craft input to the output_action_hook() function that invokes registered WordPress action hooks to escalate privileges, include arbitrary files from the server, or disable site functionality. For example, if the installation includes a plugin that registers an action hook for modifying user capabilities, the attacker could invoke that hook to promote their own account to Administrator. No public proof-of-concept code has been identified, but exploitation requires only knowledge of available WordPress action hooks-information often discoverable through plugin documentation or installation enumeration.