Avada (Fusion) Builder CVE-2026-97471

The target must run Avada (Fusion) Builder ≤3.16.1 AND have at least one page that renders the [fusion_instagram] shortcode - this is the specific prerequisite, because the required awb-instagram-nonce is only emitted (in plaintext within fusionInstagramVars) on pages using that shortcode; without such a page the nonce cannot be harvested and the endpoint cannot be triggered. No authentication or user interaction is required (PR:N/UI:N) once the nonce is obtained. Impact is maximized on WooCommerce-enabled sites where customer billing PII exists in user meta; sites not using the Instagram shortcode are not exploitable through this disclosed path.

This is a moderate-severity, low-complexity information disclosure flaw whose real-world priority sits below its signals' worst-case framing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) correctly captures a remotely reachable, unauthenticated-but-low-impact confidentiality leak with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' Two factors push real risk slightly HIGHER than the C:L rating alone suggests: the vulnerability permits extraction of arbitrary user meta for ANY user ID (admin emails, login names, wp_user_level, and WooCommerce billing PII), which is more valuable to attackers than a typical low-impact leak, and the enabling awb-instagram-nonce is printed in plaintext to anonymous visitors, removing the usual nonce barrier. One factor LIMITS it: the exploit requires a page that renders the [fusion_instagram] shortcode to expose the nonce, so sites not using that feature are not readily exploitable through this path. Net: a credible priority for Avada/WooCommerce sites that use the Instagram shortcode, but not an emergency-patch scenario absent exploitation evidence.

An anonymous attacker browses an Avada-powered WooCommerce site, finds a page rendering the [fusion_instagram] shortcode, and reads the plaintext awb-instagram-nonce from the page's fusionInstagramVars JavaScript object. Using that nonce, the attacker then iterates user IDs against the vulnerable endpoint via the args[link_target] parameter to harvest administrator login names and emails plus customer billing_email, billing_phone, and billing_address_1 for phishing or account takeover. No public exploit code was identified, but the attack is low-complexity and requires no authentication.