Critical Avada Builder Flaw Enables Unauthenticated File Deletion and Site Takeover

A critical vulnerability in the Avada (Fusion) Builder WordPress plugin, tracked as CVE-2026-8713, allows unauthenticated attackers to delete arbitrary files on affected sites and potentially seize control of them. The flaw, rated CVSS 9.1, affects all versions through 3.15.3 and is caused by insufficient file path validation in the plugin’s maybe_delete_files() function, enabling path traversal through the wp_ajax_nopriv_fusion_form_submit_ajax handler. The issue is especially dangerous on sites with a published Avada form configured to save entries to the database, where a crafted submission can trigger immediate privacy cleanup and remove sensitive files such as wp-config.php.

Security researchers said deleting key WordPress files can force a site back into setup mode, creating a path to full site compromise and possible remote code execution. The bug was reported by researcher daroo through the Wordfence Bug Bounty Program, and ThemeFusion patched it in Avada Builder 3.15.4. The vulnerability impacts a plugin ecosystem used by roughly one million WordPress sites; while there is no confirmed evidence of widespread exploitation, defenders have been urged to update immediately, and Wordfence said its firewall can block exploit attempts by detecting path traversal sequences in submitted form data.