CVE-2026-8713: Avada Builder Path Traversal Vulnerability

CVE-2026-8713 Overview

CVE-2026-8713 is an arbitrary file deletion vulnerability in the Avada (Fusion) Builder plugin for WordPress. The flaw exists in the maybe_delete_files function and affects all plugin versions up to and including 3.15.3. Insufficient file path validation lets unauthenticated attackers delete arbitrary files on the server through a path-traversal payload. Deleting sensitive files such as wp-config.php can trigger remote code execution by resetting the WordPress installation. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated attackers can delete arbitrary files on vulnerable WordPress sites, leading to site takeover and remote code execution.

Affected Products

Avada (Fusion) Builder plugin for WordPress, all versions through 3.15.3
WordPress sites with a published Avada form configured to save entries to the database
Any web host running the vulnerable plugin version

Discovery Timeline

2026-06-19 - CVE-2026-8713 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-8713

Vulnerability Analysis

The vulnerability resides in the maybe_delete_files function within the Fusion Form database entries class. The function processes file references associated with form submissions without sanitizing or validating supplied file paths. An attacker submits a Fusion form entry containing a path-traversal payload that points outside the intended upload directory. When the form's privacy expiration routine executes, the plugin deletes the file at the attacker-controlled path with the privileges of the web server.

Root Cause

The root cause is missing path canonicalization and lack of allow-listing in maybe_delete_files. The function trusts file path values stored alongside form entries and passes them directly to a delete operation. No check confirms that the resolved path remains within the plugin's upload directory.

Attack Vector

The attack requires a published Avada form configured to save entries to the database. An unauthenticated attacker submits a request to the wp_ajax_nopriv_fusion_form_submit_ajax handler containing a path-traversal payload. The attacker also controls the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate delete cleanup. The planted entry is then automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

A practical exploitation chain targets wp-config.php. Once that file is deleted, WordPress treats the site as uninstalled and presents the setup wizard, allowing an attacker to connect the site to a database under their control and execute arbitrary code. Technical details are available in the Wordfence Vulnerability Analysis and the WordPress Fusion Builder source code.

Detection Methods for CVE-2026-8713

Indicators of Compromise

POST requests to admin-ajax.php with the action=fusion_form_submit_ajax parameter containing ../ or encoded traversal sequences
Unexpected absence of wp-config.php or other core files, accompanied by the WordPress installation wizard appearing on the site
Form submissions with non-default fusion_privacy_expiration_interval or privacy_expiration_action values from unauthenticated sources
New rows in the Fusion form entries table referencing file paths outside the WordPress uploads directory

Detection Strategies

Inspect web server access logs for AJAX requests targeting wp_ajax_nopriv_fusion_form_submit_ajax with suspicious path patterns
Monitor file integrity for wp-config.php, .htaccess, and files within wp-content/plugins/ for unexpected deletions
Alert on PHP shutdown-hook activity from the Fusion Builder plugin that results in unlink() calls referencing paths outside the uploads directory

Monitoring Recommendations

Enable WordPress audit logging for form submissions and plugin file operations
Forward web server and PHP error logs to a centralized SIEM for correlation
Configure alerts on HTTP 200 responses to admin-ajax.php followed by failed authentication attempts or unexpected setup-wizard page loads

How to Mitigate CVE-2026-8713

Immediate Actions Required

Update the Avada (Fusion) Builder plugin to a version newer than 3.15.3 once the vendor releases a patched release
Audit all published Avada forms and temporarily disable those configured to save entries to the database
Review file system integrity to confirm wp-config.php and other core files have not been deleted or replaced

Patch Information

No fixed version is listed in the published NVD record at the time of writing. Administrators should monitor the Wordfence advisory and the official Avada changelog for a patched release that adds path validation inside maybe_delete_files.

Workarounds

Unpublish or remove Avada forms that persist entries to the database until a patch is installed
Deploy a Web Application Firewall (WAF) rule that blocks admin-ajax.php requests containing path-traversal sequences in form submission parameters
Restrict file system permissions so that the PHP worker process cannot delete files outside the wp-content/uploads/ directory

bash

# Example WAF/ModSecurity rule to block path traversal in Fusion form submissions
SecRule ARGS "@rx \.\./" \
  "id:1026871,phase:2,deny,status:403,\
  msg:'CVE-2026-8713 - Avada Fusion Builder path traversal attempt',\
  chain"
  SecRule ARGS:action "@streq fusion_form_submit_ajax"