What is the CVSS score of CVE-2026-8713?

CVE-2026-8713 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Avada Fusion Builder are affected by CVE-2026-8713?

A critical vulnerability in Avada (Fusion) Builder WordPress plugin (versions through 3.15.3) enables unauthenticated attackers to delete arbitrary files from affected servers, commonly escalating to…

Is there a public PoC exploit available for CVE-2026-8713?

Yes, a public proof-of-concept exploit is available for CVE-2026-8713. Prioritise patching immediately. EPSS: 1.2%.

How to fix or mitigate CVE-2026-8713?

Within 24 hours: Disable Avada Fusion Builder plugin or restrict access to the wp_ajax_nopriv_fusion_form_submit_ajax endpoint via Web Application Firewall rules. Within 7 days: Contact ThemeFusion for patch timeline; audit and restrict file system permissions to prevent web server write access to wp-config.php and wp-content directories. Within 30 days: Implement persistent file integrity monitoring, evaluate alternative page builders, or confirm patch availability and deploy.

Avada Fusion Builder CVE-2026-8713

EUVD-2026-37987 CRITICAL

Path Traversal (CWE-22)

2026-06-19 Wordfence

GHSA-47xm-33q8-pw6w

Path Traversal PHP WordPress RCE Avada Fusion Builder

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated single HTTP POST to a public AJAX endpoint deletes arbitrary files, breaking integrity and availability; no confidentiality leak until follow-on RCE.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:31 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

CRITICAL 9.1

DescriptionCVE.org

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

Articles & Coverage 1

News Critical Arbitrary File Deletion in WordPress Avada Builder ≤3.15.3 - CVE-2026-8713 Jun 19, 2026

AnalysisAI

Arbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthenticated attackers to delete any file on the server via path traversal in the maybe_delete_files function, which commonly escalates to remote code execution when wp-config.php is removed and WordPress enters setup mode. Wordfence reports the flaw is reachable through the wp_ajax_nopriv_fusion_form_submit_ajax handler on sites that have a published Avada form saving entries to the database. No public exploit identified at time of analysis, but the CVSS 9.1 score reflects trivial network exploitation with no authentication or user interaction.

Technical ContextAI

The Avada (Fusion) Builder is a commercial premium WordPress page-builder plugin from ThemeFusion bundled with the popular Avada theme, deployed on hundreds of thousands of WordPress sites. The vulnerable code path lives in inc/class-fusion-form-db-entries.php (referenced via plugins.trac.wordpress.org) inside the Fusion_Form_DB_Privacy routine that handles GDPR-style automatic deletion of form submissions. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'): the maybe_delete_files function does not normalize or sanitize stored file paths before passing them to a filesystem delete call, so attacker-controlled values containing ../ sequences resolve outside the intended uploads directory. Because the cleanup runs in a PHP shutdown hook attached to the AJAX request, exploitation is fully self-contained within a single unauthenticated POST.

RemediationAI

No vendor-released patch identified at time of analysis in the provided input - administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bfb72e-023b-4bfd-b125-91f6ac2f200f?source=cve and the ThemeFusion changelog for a release above 3.15.3 and update immediately when published. Until a fixed version is available, deactivate any Avada forms that persist entries to the database or switch those forms to email-only delivery, which removes the attacker-controllable database row that the shutdown-hook cleanup operates on at the cost of losing on-site submission records. As a defense-in-depth layer, block POST requests to admin-ajax.php where the action parameter equals fusion_form_submit_ajax and the body contains path-traversal sequences (../ or URL-encoded variants) at the WAF or reverse proxy, accepting that aggressive rules may reject legitimate form submissions that contain those characters. Filesystem hardening (running PHP as a low-privileged user with no write access to wp-config.php or plugin/core files) limits the impact of arbitrary deletion but will not by itself prevent the bug from being triggered.