CVE-2026-8713 – Unauthenticated Arbitrary File Deletion Leading to RCE – Avada (Fusion) Builder W…

Summary

CVE-2026-8713 is a critical unauthenticated arbitrary file deletion vulnerability in the Avada (Fusion) Builder WordPress plugin, affecting all versions up to and including 3.15.3. The flaw stems from insufficient file path validation in the maybe_delete_files() function, allowing unauthenticated remote attackers to delete arbitrary files on the server — including wp-config.php — which can directly result in full site takeover and remote code execution. With over one million active installations, the potential attack surface is exceptionally wide, and a patch was released on June 2, 2026 in version 3.15.4.

Technical details

• Root cause: The maybe_delete_files() function within the Fusion_Form_DB_Entries class performs no realpath resolution or upload-directory containment check, allowing path traversal sequences to escape the intended upload directory and reach arbitrary files on the server.
• Attack vector: An unauthenticated attacker submits a form payload containing a path traversal string (e.g., referencing wp-config.php via ../../ sequences) through the wp_ajax_nopriv_fusion_form_submit_ajax AJAX handler, which requires no credentials.
• Trigger conditions: Exploitation requires that a published Avada form be configured to save entries to the database — a standard and common deployment configuration. The attacker additionally controls the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate "delete" cleanup action, causing the submitted malicious path to be processed by the Fusion_Form_DB_Privacy shutdown hook without any administrator interaction.
• Impact: Deletion of critical server files. Removing wp-config.php renders the site unconfigured, enabling an attacker to reconnect it to a malicious database and install arbitrary code, effectively achieving remote code execution. Other critical files may also be targeted.

Affected software

• Avada (Fusion) Builder WordPress Plugin — all versions up to and including 3.15.3

Severity

• CVSS v3.1 Base Score: 9.1 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• CWE: CWE-22 – Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

Mitigation and recommended actions

• Immediate action: Update the Avada (Fusion) Builder plugin to version 3.15.4 or later (released June 2, 2026 as part of Avada 7.15.4). This release addresses the file path validation flaw in maybe_delete_files().
• If immediate patching is not feasible, consider temporarily disabling Avada forms that are configured to save entries to the database until the update can be applied.
• Audit web server file integrity monitoring for unexpected deletions of wp-config.php or other core WordPress files, which may indicate prior exploitation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-8713 at NIST NVD
• ThemeFusion – Avada Version 7.15.4 Security Update