Avada Core CVE-2026-65471

Exploitation requires an authenticated WordPress user - typically an administrator with access to the vulnerable Avada Core action - to be tricked into visiting attacker-controlled content while their session is active (UI:R is present in the CVSS vector). No attacker authentication is needed (PR:N), and attack complexity is low (AC:L). Limiting factors: the victim must hold sufficient privileges for the targeted action, must be logged in at the time, and must perform the interaction; the description does not name the exact vulnerable feature/endpoint or parameter, so the precise action that gets forged is not confirmed from available data. The plugin must be installed at version 5.15.6 or earlier.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) is aggressive for a generic CSRF: the network vector and no-privilege metric are consistent with CSRF, but S:C and full C:H/I:H/A:H imply the forged request yields complete compromise, which the one-line description does not substantiate. The UI:R requirement is a meaningful limiter - an authenticated (typically admin) user must be lured into clicking an attacker-controlled link or page, so this is not autonomously wormable. No EPSS value, no KEV listing, and no POC were provided, so real-world exploitation signals are absent; the elevated score reflects theoretical worst-case impact rather than confirmed mass exploitation. CONFLICT TO VERIFY: the vendor's C:H/I:H/A:H and S:C are not supported by any impact detail in the description - treat the true impact as unconfirmed pending vendor advisory review.

An attacker crafts a web page or email containing a hidden auto-submitting form (or image/script request) targeting a state-changing Avada Core endpoint, then lures a logged-in WordPress administrator to open it. Because the endpoint does not verify an anti-CSRF nonce, the victim's browser submits the forged request with valid session cookies, executing the privileged action under the admin's identity. No public POC is referenced, and the low attack complexity (AC:L) means the forged request itself is trivial to construct once the vulnerable handler is known.