CVE-2026-97471: Avada Builder Information Disclosure Flaw

CVE-2026-97471 Overview

CVE-2026-97471 is a sensitive information exposure vulnerability in the Avada (Fusion) Builder plugin for WordPress. All versions up to and including 3.16.1 are affected. The flaw resides in the args[link_target] parameter and allows unauthenticated attackers to extract arbitrary user meta values for any user ID. Exposed data includes administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to reach the endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it trivially harvestable by anonymous visitors.

Critical Impact
Unauthenticated attackers can enumerate administrator credentials and customer PII from any WordPress site running a vulnerable Avada Builder installation that renders the Instagram shortcode.

Affected Products

Avada (Fusion) Builder plugin for WordPress — all versions through 3.16.1
WordPress sites rendering the [fusion_instagram] shortcode
WooCommerce stores using Avada Builder where customer billing meta is stored

Discovery Timeline

2026-10-14 - CVE-2026-97471 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97471

Vulnerability Analysis

The vulnerability is a classified Information Exposure flaw [CWE-200] in the Avada Builder Instagram shortcode handler. The AJAX endpoint protected by the awb-instagram-nonce accepts an args[link_target] parameter that is passed into a user meta lookup without proper validation of the requested meta key or user ID. An attacker can iterate through user IDs and arbitrary meta keys to extract sensitive values.

The nonce intended to gate the endpoint provides no real protection. It is printed in plaintext within the fusionInstagramVars JavaScript object on every page that renders the [fusion_instagram] shortcode. Any anonymous visitor can fetch that page, scrape the nonce, and immediately issue the exploit request.

Extractable fields include user_email, user_login, wp_user_level, and WooCommerce billing fields. The combination of login names and wp_user_level lets attackers identify administrator accounts, which can then feed targeted password-spraying or phishing campaigns.

Root Cause

The root cause is missing authorization and insufficient input validation on the shortcode's AJAX handler. The handler trusts the args[link_target] parameter as a meta key lookup for an attacker-supplied user ID. It does not restrict callers to the data the shortcode actually needs, and it does not enforce a capability check beyond the public nonce.

Attack Vector

Exploitation requires only network access to a vulnerable site and no authentication or user interaction. The attacker first requests any public page containing the [fusion_instagram] shortcode, parses the awb-instagram-nonce value from fusionInstagramVars, then sends a crafted AJAX request supplying a target user_id and args[link_target] meta key. The response discloses the requested user meta value.

See the Wordfence Vulnerability Report for the full technical write-up.

Detection Methods for CVE-2026-97471

Indicators of Compromise

Repeated unauthenticated AJAX requests to the Avada Instagram endpoint containing an args[link_target] parameter referencing meta keys such as user_email, user_login, wp_user_level, or billing_*.
Sequential enumeration of user_id values from the same source IP against the same endpoint within a short time window.
Anonymous GET requests to pages containing [fusion_instagram] immediately followed by POST requests to the Instagram AJAX handler.

Detection Strategies

Inspect web server and WordPress access logs for admin-ajax.php or REST calls carrying awb-instagram-nonce plus args[link_target] values that do not correspond to legitimate Instagram link targets.
Alert on response bodies from the Instagram endpoint containing substrings matching email, phone, or address patterns.
Correlate nonce harvesting (page views of shortcode-bearing URLs) with subsequent high-volume AJAX activity from the same client fingerprint.

Monitoring Recommendations

Enable verbose logging on the WordPress AJAX and REST layers and forward logs to a centralized analytics platform for pattern analysis.
Monitor outbound DNS and SMTP for signs that harvested administrator or customer email addresses are being used in follow-on phishing campaigns.
Track plugin inventory and version drift across all WordPress hosts to identify systems still running Avada Builder 3.16.1 or earlier.

How to Mitigate CVE-2026-97471

Immediate Actions Required

Update the Avada (Fusion) Builder plugin to the version released in the Avada 7.16.2 Security Update or later.
Audit all WordPress sites for pages rendering the [fusion_instagram] shortcode and treat them as exposed until patched.
Rotate administrator passwords and force password resets for WooCommerce customers if logs indicate the endpoint was abused.

Patch Information

Avada published a security fix in the 7.16.2 release. Refer to the vendor advisory at the Avada Security Update Post for complete remediation guidance and bundled fixes.

Workarounds

Remove or disable the [fusion_instagram] shortcode on all public pages until the plugin is updated.
Deploy a web application firewall rule that blocks unauthenticated requests to the Avada Instagram AJAX endpoint containing an args[link_target] parameter.
Restrict access to admin-ajax.php for the Avada Instagram action by source IP where feasible.

bash

# Example WAF rule concept to block exploit requests
# Reject POSTs to admin-ajax.php where action=fusion_instagram and args[link_target] targets user meta keys
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026097471,msg:'CVE-2026-97471 Avada Builder user meta extraction'"
  SecRule ARGS:action "@streq fusion_instagram" "chain"
  SecRule ARGS:'args[link_target]' "@rx (user_email|user_login|wp_user_level|billing_)"