CVE-2026-8713
published 2026-06-19CVE-2026-8713: The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files…
PriorityP187critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.19%
64.1th percentile
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themefusion | avada_builder | <= 3.15.3 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated POST requests to the wp_ajax_nopriv_fusion_form_submit_ajax WordPress AJAX handler, especially those containing path-traversal sequences in form field values. ↗
- →Alert on deletion of wp-config.php on WordPress servers, as this is the primary high-impact target enabling site takeover and RCE via the CVE-2026-8713 exploit chain. ↗
- →Inspect form submissions for manipulation of the fusion_privacy_expiration_interval and privacy_expiration_action fields, which are abused to trigger immediate 'delete' cleanup via the Fusion_Form_DB_Privacy shutdown-hook routine. ↗
- →The attack requires a published Avada form configured to save entries to the database; assess exposure by auditing all active Avada forms for database-save configuration. ↗
- ·Exploitation is only possible when at least one published Avada form is configured to save submissions to the database; sites without such forms are not directly exploitable. ↗
- ·No active in-the-wild exploitation of CVE-2026-8713 had been observed at time of reporting, but the vulnerability was flagged as a high-likelihood exploitation candidate. ↗
- ·The vulnerability affects all versions of the Avada (Fusion) Builder plugin up to and including 3.15.3; version 3.15.4 contains the fix. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vulncheck9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and includin
ghsa_unreviewed·2026-06-19
CVE-2026-8713 [CRITICAL] CWE-22 The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and includin
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically proc
VulnCheck
theme-fusion avada_builder Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2026·CVSS 9.1
CVE-2026-8713 [CRITICAL] theme-fusion avada_builder Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
theme-fusion avada_builder Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expirati
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
blogs_hackernews·2026-06-22·CVSS 9.8
CVE-2026-24858 [CRITICAL] ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
It’s Monday again.
This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control.
The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are used to push more attacks. Nothing clever. Just sloppy, cheap, and effective.
Here’s the Monday recap. Let’s get into the week’s mess.
## ⚡ Threat of the We
Bleepingcomputer
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
blogs_bleepingcomputer·2026-06-19·CVSS 7.5
CVE-2026-4020 [HIGH] Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
## Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
## Bill Toulas
Threat actors are exploiting an unauthenticated information disclosure vulnerability in the WordPress plugin Gravity SMTP, active on 100,000 sites.
The flaw is tracked as CVE-2026-4020 and received a medium severity rating. It affects all versions of the plugin from 2.1.4 and older and has been addressed in version 2.1.5, released on March 17.
WordPress security company Defiant is warning that hackers are actively exploiting the vulnerability. The company's Wordfence firewall has blocked more than 17 million attempts against protected customers.
The issue stems from an exposed REST API endpoint in Gravity SMTP, whose ‘permission_callback’ always returns ‘true,’ allowing unauthenticated GET requests
2026-06-19
Published
Exploited in the wild