Avada Custom Branding CVE-2026-65524

Exploitation requires an authenticated WordPress session with at minimum the contributor role - unauthenticated access is not possible per the CVSS PR:L metric. The vulnerability is specific to sites running the Avada Custom Branding plugin version 1.2 or earlier; sites not using this plugin are unaffected. No additional non-default configuration is required beyond having the plugin installed and active. Exploitation is limited to read-only access (C:L, I:N, A:N), so attackers cannot modify or delete data through this vector. The contributor role is a non-default WordPress role that must be explicitly assigned, which limits realistic attacker pool to invited users or compromised contributor accounts.

The CVSS base score of 4.3 (Medium) is consistent with the limited blast radius: AV:N indicates the exploit is network-reachable (via HTTP), AC:L means no special conditions complicate the attack, but PR:L requires the attacker to hold a contributor-level account, which is a meaningful barrier in most WordPress deployments. Scope is Unchanged (S:U) and impact is confined to partial confidentiality (C:L) with no integrity or availability effect. No EPSS data was provided in the intelligence, and the vulnerability is neither listed in the CISA KEV catalog nor accompanied by known public proof-of-concept code. In practice, risk is low-to-medium: exploitation requires an internal or invited contributor account, and the data exposed is likely limited to branding/white-label configuration rather than credentials or PII. For multi-tenant or agency-managed WordPress environments where contributor accounts are granted to external clients, the risk is slightly elevated.

An attacker who holds or has obtained a contributor-level WordPress account on a target site running Avada Custom Branding <= 1.2 sends a crafted authenticated HTTP request to a plugin-registered endpoint or admin-ajax action that lacks a proper capability check. The missing authorization gate allows the request to succeed, returning restricted branding configuration data visible only to administrators. No public proof-of-concept code has been identified at time of analysis.