+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHosting

CVE-2026-97670: Avada Fusion Builder 7.16.1 Fires Any WP Hook Without a Login - Patch 7.16.2

By ServerGurus Team12 October 20266 min read
CVE-2026-97670: Avada Fusion Builder 7.16.1 Fires Any WP Hook Without a Login - Patch 7.16.2

The Situation

NVD published CVE-2026-97670 on 2026-10-10T05:16:40.850. Wordfence Intelligence lists it as publicly published 9 October 2026 (record last updated 10 October 2026). The CNA record was last updated 2026-10-11T16:55:18.939Z, which is when CISA's ADP attached SSVC. Product: WordPress plugin Avada (Fusion) Builder, slug fusion-builder. Affected: all versions through 7.16.1. Patched: 7.16.2.[1][2]

Wordfence / NVD CVSS v3.1 is 9.1 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Privileges required: none. User interaction: none. Confidentiality is None on that vector - Wordfence is scoring irreversible content destruction and DoS, not a data-exfil RCE.[1][2]

This is not WordPress core. It is ThemeFusion's page-builder plugin that ships with the Avada theme. CISA KEV catalog 2026.10.08 (1,739 entries, newest add still 8 October) does not list this CVE. CISA ADP SSVC on 11 October is Exploitation: none, Automatable: yes, Technical Impact: partial. Treat it as a fresh unauth-critical plugin, not as a KEV clock.[1][3]

ThemeFusion's Avada 7.16.2 post is dated 30 September 2026. Changelog.txt same date, first security line: "Fixed possible XSS and injection vulnerability in Avada Forms submissions / notification emails." The CVE number landed ten days later. Wordfence's fix URL is that 7.16.2 post; we are not claiming every bullet on that page is this CVE.[4][5]

fusion-builder is not on WordPress.org (plugin API 404). You will not see it in wp plugin search. Hunt the slug on disk.[11]

What the bug actually is

NVD / Wordfence, verbatim: the plugin "is vulnerable to authorization bypass in all versions up to, and including, 7.16.1" because it dispatches a WordPress action hook whose name is taken from an attacker-supplied form-field value - via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token. The older 3.16.1 trust gate is_content_request_supplied() "only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses."[1][2]

Result, their wording: unauthenticated attackers can invoke arbitrary WordPress action hooks (multiple per request). Wordfence says they verified an unauthenticated request that permanently deleted trashed posts, pages, and comments via core wp_scheduled_delete. Other non-deny-listed hooks: denial of service (they name wp_maybe_auto_update) and, "where vulnerable third-party handlers are installed, further privileged writes." Same pipeline: blind arbitrary user/post-meta read, delivered only to the site owner, "not attacker-exfiltrable through the plugin's own email/response paths."[1][2]

Prerequisite they state: a published Avada form with AJAX submission and a notification whose email_message template includes [all_fields] or an explicit [field] placeholder - "the default form configuration."[1][2]

Researchers on the Wordfence record: Chloe Chamberland and Wordfence Argus. CWE: CWE-94. Timeline in the CNA: vendor notified 2026-09-24, disclosed 2026-10-09.[2]

We are not publishing a form-field payload. Do not treat this paragraph as a lab result from us.

This is not remote code execution in the NVD vector. C:N is deliberate. "Further privileged writes" if other plugins hang handlers on those hooks is Wordfence's hedge, not a demonstrated webshell in this CVE.[1][2]

Hunt the fleet - prove absence

Do not grep for "Avada" in the theme directory and call it done. The CNA product is the plugin slug fusion-builder. Avada the theme is a separate tree. Check both; patch both to 7.16.2.

# locate the slug (cPanel/CloudLinux homes, Plesk vhosts, generic)
find /home /var/www /srv -path '*/wp-content/plugins/fusion-builder' -type d 2>/dev/null
find /home /var/www /srv -path '*/wp-content/themes/Avada' -type d 2>/dev/null

# version from headers, no PHP bootstrap required
grep -hE '^[[:space:]]*\*?[[:space:]]*Version:' \
  /home/*/public_html/wp-content/plugins/fusion-builder/fusion-builder.php \
  2>/dev/null
grep -hE '^Version:' \
  /home/*/public_html/wp-content/themes/Avada/style.css \
  2>/dev/null

# per-site, when wp-cli is on the account
wp plugin get fusion-builder --field=version --skip-plugins --skip-themes
wp theme get Avada --field=version --skip-plugins --skip-themes

Anything fusion-builder ≤ 7.16.1 is in range. Wordfence's patched version is 7.16.2. Avada's own current version on the 30 Sep changelog is 7.16.2. Because this plugin is premium / bundled, wp plugin update fusion-builder from wordpress.org will fail - update from ThemeFusion / Envato / Avada Patcher the way you already ship Avada.[2][4][5]

If you cannot patch today: Wordfence's own prerequisite is a published Avada form with AJAX + [all_fields]/[field]. Compensating control is take those forms offline or deactivate fusion-builder, not "disable comments." That is not a substitute for 7.16.2.[1][2]

After 7.16.2: look for unexpected empties in trash (Wordfence's verified impact is permanent delete of already-trashed content, not a live-post wipe in the text they published). We did not produce IOCs.[1][2]

Honesty / What We Could Not Verify

  • We did not exploit this. No PoC was run against a lab or a customer vhost.
  • Not on CISA KEV as of catalog version 2026.10.08 (count 1739, last dateAdded 2026-10-08). We re-read that JSON this morning. CISA ADP SSVC same CVE: Exploitation none as of 2026-10-11T16:41:57.942452Z. Absence from KEV is not absence of scanners.[1][3]
  • Not RCE. Vector is C:N/I:H/A:H. Wordfence verified wp_scheduled_delete on trashed content. "Further privileged writes" depends on other plugins' hooks. We did not map those hooks.[1][2]
  • Default form config. Wordfence says AJAX + [all_fields]/[field] is the default. We did not inventory how many Avada forms on our fleet still match that. Patch anyway; do not inventory form JSON as the ticket close.[1][2]
  • Vendor blog vs CVE. 7.16.2 shipped 30 Sep with six SECURITY lines and no CVE ID. Closest wording is the Forms submissions / notification emails line. Wordfence points at that post as the remediation URL. We are not collapsing the other five bullets into this CVE. One of them matches CVE-2026-97340 (Avada theme ≤ 7.16.1 Subscriber+ stored XSS via author social profile fields, CVSS 6.4 MEDIUM) - different bug, still 7.16.2.[4][5][10]
  • Theme vs plugin version. CNA product is Avada (Fusion) Builder ≤ 7.16.1. Changelog current is Avada 7.16.2. We did not unzip a 7.16.2 package to prove the bundled fusion-builder.php header is also 7.16.2. Check the plugin header, not just the theme screenshot version.[2][5]
  • 3.16.1 in the description is Wordfence naming the old trust-gate version, not a second affected product line you can ignore if you already passed 3.x. The affected range they published is 0 through 7.16.1.[1][2]
  • Install count. No wordpress.org active_installs (slug 404).[11] ThemeForest marketing numbers are vendor-reported and not used here.
  • This lab did not install Avada or Fusion Builder.

What this is not

  • Not CVE-2026-94589 (Extensions For CF7 ≤ 3.4.5 unauth file upload, CVSS 9.8, patched 3.4.6, NVD 10 Oct). Different slug (extensions-for-cf7). Already in the queue.[9]
  • Not CVE-2026-104732 (Advanced IP Blocker ≤ 8.13.13 unauth 2FA bypass, CVSS 9.8, Wordfence patched 8.13.14; wordpress.org stable 8.13.16 as of 2026-10-10 12:39pm GMT, active_installs 2000). Requires the plugin's 2FA feature and a known user_id. Different slug (advanced-ip-blocker). Smaller blast radius than Avada on a hosting fleet, which is why it lost the pick today.[6][7][8]
  • Not CVE-2026-18431 (Avada ≤ 7.16 + Fusion Builder ≤ 3.16 unauth file-write RCE, Wordfence 25 Aug 2026). Older chain. Still patch, different CVE.[2]
  • Not a cPanel / Plesk / LiteSpeed CVE. No new named-stack KEV since catalog 2026.10.08.

Sources

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-97670 - NVD CVE-2026-97670 [2] https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c00795-c49b-4b0a-8f0a-4ed18c966c6b?source=cve - Wordfence CVE-2026-97670 [3] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON [4] https://avada.com/blog/version-7-16-2-security-update - Avada 7.16.2 security update [5] https://classic.avada.com/wp-content/uploads/2023/03/changelog.txt - Avada changelog.txt [6] https://nvd.nist.gov/vuln/detail/CVE-2026-104732 - NVD CVE-2026-104732 [7] https://www.wordfence.com/threat-intel/vulnerabilities/id/d080845b-6814-4b10-a3ab-1f5aa1d09132?source=cve - Wordfence CVE-2026-104732 [8] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=advanced-ip-blocker - WordPress.org plugin API advanced-ip-blocker [9] https://nvd.nist.gov/vuln/detail/CVE-2026-94589 - NVD CVE-2026-94589 [10] https://nvd.nist.gov/vuln/detail/CVE-2026-97340 - NVD CVE-2026-97340 [11] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=fusion-builder - WordPress.org plugin API fusion-builder 404

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales