What is the CVSS score of CVE-2026-1541?

CVE-2026-1541 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Avada Fusion Builder CVE-2026-1541

EUVD-2026-22822 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-15 Wordfence

WordPress Authentication Bypass Information Disclosure Avada Fusion Builder Themefusion

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:48 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 01:45 euvd

EUVD-2026-22822

Analysis Generated

Apr 15, 2026 - 01:45 vuln.today

CVE Published

Apr 15, 2026 - 01:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusion_get_post_custom_field() function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature's post_custom_field parameter.

AnalysisAI

Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's post_custom_field parameter due to insufficient validation of underscore-prefixed metadata keys. The fusion_get_post_custom_field() function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The Avada Fusion Builder is a WordPress page builder plugin that provides dynamic content functionality through shortcodes and parameters. The vulnerability exists in the fusion_get_post_custom_field() function, which handles retrieval of custom post metadata via the post_custom_field parameter in the Dynamic Data feature. WordPress conventionally protects metadata keys prefixed with underscores by default, restricting their access to privileged users. This plugin fails to perform equivalent validation before exposing metadata values, creating a bypass of standard WordPress metadata access control patterns (CWE-639: Authorization Bypass Through User-Controlled Key). The affected product is identified by CPE cpe:2.3:a:themefusion:avada_(fusion)_builder:*:*:*:*:*:*:*:*, affecting all versions up to and including 3.15.1 distributed through ThemeForest.

RemediationAI

The primary remediation is to upgrade the Avada Fusion Builder plugin to a patched version above 3.15.1. Users should navigate to their WordPress admin dashboard, select Plugins, locate Avada Fusion Builder, and click Update if a newer version is available. Verify through the official ThemeForest product page or Wordfence threat intelligence that the upgrade resolves the fusion_get_post_custom_field() function validation issue. As an interim mitigation, restrict Subscriber-level user accounts to trusted users only and review custom post metadata to identify sensitive fields that may have been exposed. Audit access logs in Wordfence or similar security plugins to determine if unauthorized metadata extraction has occurred. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f69f93-80e3-434d-98a6-fc8757b4e6d1?source=cve for detailed technical remediation guidance and patch availability confirmation.