CVE Tools
Sign in
Back to feed
Patch released Avada Builder (Fusion) web-app ThemeFusion rce

1M WordPress Sites at Risk: Critical Unauthenticated Arbitrary File Deletion in Avada Builder (CVSS 9.1)

Daily CyberSecurity (securityonline.info)·By Do Son··2 min read
CVE Tools coverage

A critical vulnerability in themefusion Avada (Fusion) Builder, tracked as CVE-2026-8713 (CVSS 9.1), allows unauthenticated attackers to delete arbitrary files on affected servers without login. Versions at or below 3.15.3 are impacted, and the ability to remove sensitive files can lead to full compromise of a WordPress site. Site owners should upgrade to Avada Builder v3.15.4 or later immediately, even though there is no confirmed public exploitation reported yet.

Open on Daily CyberSecurity (securityonline.info)

Related coverage

Other stories on the same CVEs
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure