Critical WordPress Plugin Bug Exposes 1M Sites to File Deletion

Key Takeaways

• A critical vulnerability (CVE-2026-8713) in the Avada (Fusion) Builder WordPress plugin allows unauthenticated attackers to delete arbitrary files.
• Over one million websites using Avada Builder versions up to 3.15.3 are exposed to potential full site compromise and remote code execution.
• The flaw, with a CVSS score of 9.1, was discovered by “daroo” and has been patched in Avada Builder version 3.15.4.

Critical Avada WordPress Plugin Bug Exposes Million Sites to File Deletion

A severe security flaw has been identified within the widely deployed Avada (Fusion) Builder WordPress plugin, leaving more than one million websites susceptible to arbitrary file deletion attacks. This vulnerability could lead to complete site compromise and potentially enable remote code execution.

The vulnerability, designated as CVE-2026-8713 and assigned a critical CVSS score of 9.1, was brought to light by security researcher “daroo” through the Wordfence Bug Bounty Program. The researcher was awarded $3,600 for their discovery. The issue impacts all plugin versions up to 3.15.3, with a fix implemented in version 3.15.4.

Technical Details of the Avada WordPress Plugin Vulnerability

The core of the problem lies in inadequate file path validation within the plugin’s maybe_delete_files() function, which handles file deletion logic. This oversight permits unauthenticated attackers to exploit a path traversal vulnerability, enabling them to delete any file on the server.

Attackers can leverage Avada’s form builder feature, specifically when a form is configured to store submissions directly in the database. By submitting a specially crafted payload containing directory traversal sequences, an attacker can manipulate file paths to target sensitive files located outside the intended upload directory.

The attack scenario requires an Avada form that is publicly accessible and has database storage enabled. An attacker would submit a malicious form entry containing a path similar to /wp-content/uploads/fusion-forms/../../../wp-config.php. Due to the absence of proper validation checks, the plugin processes this input during its automated privacy cleanup routine. Subsequently, WordPress’s native file deletion function is invoked to remove the targeted file.

Crucially, the attacker can trigger this cleanup process instantly by controlling specific form parameters, eliminating the need for any authentication or administrator interaction. Deleting vital files, such as wp-config.php, can force WordPress into a setup state. This allows attackers to reconfigure the site using a malicious database, ultimately resulting in a full site takeover and remote code execution capabilities.

Given the widespread adoption of the Avada plugin and the relative ease of exploitation, this vulnerability presents a significant risk to all affected websites.

Disclosure and Patch Information

The vulnerability was initially reported to Wordfence on May 13, 2026. Following validation, the details were disclosed to the Avada vendor on May 15. The Avada development team promptly patched the flaw on May 19, with the official release of Avada version 3.15.4 occurring on June 2, 2026. Wordfence users benefit from built-in firewall rules that automatically detect and block path traversal attempts in form submissions, providing immediate protection.

This incident underscores the persistent dangers associated with insufficient input validation in file-handling functions and emphasizes the critical importance of secure coding practices in plugin development. Without robust directory containment checks or secure file path resolution, systems remain vulnerable to traversal sequences that can escape intended directories, leading to arbitrary file deletion.

What You Should Do

• Update Immediately: All users of the Avada (Fusion) Builder WordPress plugin must update to version 3.15.4 or higher without delay. Websites running older versions are at severe risk of active exploitation.
• Verify Form Configurations: Review all Avada forms on your site to ensure they are configured securely, especially regarding database storage and public accessibility.
• Implement Web Application Firewall (WAF): Utilize a robust WAF, such as Wordfence, to provide an additional layer of protection against path traversal and other common web attacks.
• Regular Backups: Maintain regular, verified backups of your entire WordPress site, including both files and databases, to facilitate recovery in the event of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.