What is the CVSS score of CVE-2026-65471?

CVE-2026-65471 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Avada Core are affected by CVE-2026-65471?

The Avada Core WordPress plugin (fusion-core) versions 5.15.6 and earlier contains a critical cross-site request forgery vulnerability (CVSS 9.6) that allows unauthenticated attackers to manipulate…

How to fix or mitigate CVE-2026-65471?

Within 24 hours: Conduct inventory of all WordPress installations to identify Avada Core/fusion-core at versions 5.15.6 or earlier and prioritize by criticality and exposure; review administrator access logs for suspicious cross-origin requests or unexpected administrative actions. Within 7 days: Implement Web Application Firewall (WAF) CSRF token validation rules, enable SameSite cookie policies across all WordPress instances, and restrict administrative dashboard access to whitelisted IP ranges; evaluate alternative plugins or custom solutions as replacements. Within 30 days: Migrate affected WordPress sites to alternative, patched solutions or implement multi-factor authentication for all administrative accounts and establish continuous monitoring for unauthorized administrative API calls; conduct security awareness training on CSRF attack vectors for administrative staff.

Avada Core CVE-2026-65471

EUVD-2026-48083 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-92mf-w334-37r6

CSRF Avada Core WordPress Wordpress Plugin

9.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

CSRF needs a lured authenticated victim (UI:R, PR:N); the terse description gives no evidence of full compromise or scope change, so I downgrade to S:U with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:35 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

AnalysisAI

Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

Avada Core is the companion plugin bundled with the widely-sold Avada WordPress theme, providing shortcodes, portfolio/FAQ post types, and site-building features (the internal/repository slug is 'fusion-core', per the Patchstack reference). The root cause is CWE-352, Cross-Site Request Forgery: one or more privileged action handlers process requests without validating a WordPress nonce or equivalent anti-CSRF token, so the server cannot distinguish a legitimate in-app request from one forged by a third-party site. The single CPE provided, cpe:2.3:a:avada_studio:avada_core:*:*:*:*:*:*:*:*, identifies the affected component but does not enumerate a lower version bound.

RemediationAI

No specific fixed version was provided in the input data - no vendor-released patch version is independently confirmed at time of analysis; consult the Avada vendor/ThemeAdvisor advisory and the Patchstack entry (https://patchstack.com/database/wordpress/plugin/fusion-core/vulnerability/wordpress-avada-core-plugin-5-15-6-cross-site-request-forgery-csrf-vulnerability) and upgrade Avada Core to the first release above 5.15.6 once published. As compensating controls until a patch is applied, deploy a WordPress WAF or Patchstack's virtual patching to block forged cross-origin POSTs, enforce SameSite=Strict/Lax on session cookies to blunt cross-site request delivery (side effect: may break legitimate cross-site integrations), and instruct administrators to log out of wp-admin when browsing untrusted sites and avoid clicking unsolicited links while authenticated. Restricting wp-admin access by IP allowlist further reduces the exposure window at the cost of remote-admin convenience.