Avada Fusion Builder CVE-2026-8713

The target WordPress site must have the Avada (Fusion) Builder plugin at version 3.15.3 or earlier installed and activated, and must have at least one published Avada form whose configuration saves submitted entries to the database - forms that only email submissions do not create the database row the shutdown hook later processes. The attacker reaches the bug through the unauthenticated wp_ajax_nopriv_fusion_form_submit_ajax endpoint and must control three submitted fields simultaneously: the file path being stored (carrying the ../ traversal), fusion_privacy_expiration_interval, and privacy_expiration_action set to force an immediate 'delete' cleanup so the entry is processed within the same request's shutdown hook rather than later. No authentication, no user interaction, and no administrator action are required (consistent with CVSS PR:N/UI:N), and the PHP filesystem user must have permission to unlink the target file (wp-config.php and other webroot files normally satisfy this on default LAMP-style hosting).

All signals point to a high-priority issue requiring rapid patching. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H scoring 9.1 confirms network reach, no authentication, no user interaction, and high integrity and availability impact - consistent with the description that the shutdown-hook deletion fires without administrator interaction. There is no CISA KEV listing and no EPSS score in the input, so a precise probability of exploitation cannot be quoted, but the WordPress plugin attack surface, the trivial trigger primitive, and the well-known wp-config.php deletion to RCE pivot make in-the-wild scanning highly plausible once the Wordfence advisory is indexed. The one limiting factor is configuration-dependent: the target site must have a published Avada form that saves entries to the database, which tempers but does not eliminate mass-exploitation risk because that is a common Avada use case. No public exploit identified at time of analysis, so this is currently a high-CVSS, high-realistic-risk advisory rather than confirmed mass exploitation.

An unauthenticated attacker discovers a WordPress site running Avada with a published form that saves entries to the database, then submits a single crafted POST to /wp-admin/admin-ajax.php?action=fusion_form_submit_ajax embedding a path-traversal payload pointing at wp-config.php and setting fusion_privacy_expiration_interval plus privacy_expiration_action so the entry is immediately eligible for deletion. The shutdown hook fires within the same request, the Fusion_Form_DB_Privacy routine invokes maybe_delete_files on the unsanitized path, and wp-config.php is removed; the attacker then revisits the site, which enters the WordPress setup wizard and lets them attach a database they control, yielding full administrator access and remote code execution via plugin/theme upload. No public exploit identified at time of analysis, but the chain is straightforward to weaponize from the description alone.