Avada Fusion Builder CVE-2026-1543

Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges on the target site - attackers must be authenticated (CVSS PR:L confirmed). The Dynamic Data feature of the Avada (Fusion) Builder must be in active use on at least one published page, specifically pulling and rendering user-supplied data such as biographical information via a vulnerable shortcode. The injected payload only executes when a victim user (typically an administrator) loads such a page; the attacker cannot force this page view and must rely on normal administrative browsing behavior. Sites with closed or restricted user registration significantly limit the attacker pool to already-trusted users. The vulnerability affects the plugin across all WordPress hosting environments with no platform-specific restriction noted.

The CVSS 6.4 score reflects a meaningful but bounded threat profile. The vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N shows network-reachable exploitation with low attack complexity and no user interaction required by the attacker post-injection - however, PR:L confirms that a valid authenticated account at Subscriber level or higher is a hard prerequisite, which meaningfully limits opportunistic mass exploitation compared to unauthenticated flaws. The Changed Scope is the most consequential signal: a low-privilege attacker can affect a high-privilege victim's session, making account takeover a realistic downstream impact despite the moderate base score. No EPSS score was provided in the intelligence data, so probability-weighted exploitation likelihood cannot be quantified here. No CISA KEV listing exists and no public proof-of-concept has been identified, suggesting this has not yet attracted automated or widespread exploitation. For sites with open user registration (allowing arbitrary subscriber accounts), the realistic risk is elevated; for sites with closed registration, the attacker surface is sharply narrowed to existing authenticated users.

An attacker registers a free subscriber account on a WordPress site running Avada Fusion Builder and edits their profile's Biographical Info field to inject a JavaScript payload such as a cookie-stealing script. When a site administrator later navigates to any page configured with a Dynamic Data shortcode that renders user biographical information, the stored script executes silently in the administrator's browser, exfiltrating their session token to an attacker-controlled server and enabling full administrative account takeover. No public proof-of-concept has been identified, but the attack pattern is well-understood and requires no specialized tooling beyond a registered account.