Avada Fusion Builder CVE-2026-1541

The vulnerability carries a CVSS v3.1 score of 4.3 with a vector indicating network-based attack (AV:N), low complexity (AC:L), low privilege requirement (PR:L for Subscriber level), no user interaction (UI:N), and unchanged scope (S:U) with low confidentiality impact (C:L). While the CVSS rating is moderate, real-world risk is contextual: the attack requires valid WordPress user credentials at Subscriber level or above, which is commonly assigned to registered users on many WordPress sites. The confidentiality impact is limited to exposure of post metadata, not full database or application compromise. This is not an unauthenticated remote code execution scenario; it is a privilege escalation within the WordPress user hierarchy where authenticated users access metadata beyond their intended permissions. The information disclosed could include sensitive custom fields, API keys stored as post metadata, or business-critical data not intended for public access. Organizations relying on metadata privacy controls for data separation should prioritize remediation.

An authenticated WordPress user with Subscriber-level access crafts a request to the Avada Fusion Builder plugin's Dynamic Data feature, using the post_custom_field parameter to enumerate and retrieve post metadata keys beginning with underscores (e.g., _custom_api_key, _stripe_token). The plugin's fusion_get_post_custom_field() function processes the request without validating the underscore prefix convention and returns the metadata value, exposing sensitive information stored in post custom fields. The attacker does not require administrative privileges, only a valid user account, making this a practical privilege escalation attack on WordPress installations where subscriber roles are widely assigned.