CVE-2026-8713

This vulnerability lets a stranger send a request to your website that tells the plugin to delete a file. With a crafted “file path” value, they can target the wrong file—not just a harmless temporary one. Deleting the right file (for example, the site’s configuration file) can let an attacker take over your website.

This matters to you if you run a WordPress site that uses the themefusion Avada (Fusion) Builder plugin version 3.15.3 or older. Because the problem can be triggered without logging in, it’s not limited to admins or employees. The affected product is the Avada (Fusion) Builder plugin from themefusion.

This is RED urgency because press reporting indicates it is being exploited in the wild. Even though there is no known public exploit, attackers don’t need a special tool if they can send the right crafted request, and the outcome (file deletion leading to takeovers) is severe. You should prioritize patching and reducing exposure immediately.

1. Patch: Update the themefusion Avada (Fusion) Builder plugin to a version greater than 3.15.3 that includes the fix. Confirm the plugin version in WordPress after updating.

2. Reduce exposure while patching (if you can’t update immediately):

• Disable or remove any Avada forms that are set up to save entries to the database.
• If your site uses Avada form features heavily, consider temporarily blocking form submission routes until you can update (coordinate with your IT/host).

3. Verify file integrity:

• Look for evidence that important files were deleted or modified (for example, site configuration files such as wp-config.php). If you have backups, compare file timestamps and contents.
• Check WordPress “recent changes” in plugins/themes and confirm no unexpected admin accounts or backdoors were added (file deletion leading to remote code execution implies follow-on compromise is possible).

4. Monitor after changes:

• Review web server logs / WordPress logs for unusual requests hitting the form submission endpoint (the wp_ajax_nopriv_fusion_form_submit_ajax handler is specifically involved per the description).
• Keep an eye out for repeated suspicious requests and any post-exploitation signs (new files, altered configuration, unexpected scheduling tasks).

5. Backstop with backups:

• Ensure you have a recent, known-good backup. If there are signs of compromise or file deletion, plan a restore and re-hardening rather than only patching.

CVE-2026-8713 affects the themefusion Avada (Fusion) Builder WordPress plugin versions up to and including 3.15.3. The vulnerability is unauthenticated arbitrary file deletion caused by insufficient file path validation in the maybe_delete_files function.

Attack outline (as described):

• An attacker must have an Avada form on the site configured to save entries to the database.
• The attacker sends a request to wp_ajax_nopriv_fusion_form_submit_ajax (no authentication required) with a path-traversal payload in a form entry value.
• The attacker also controls fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate “delete” cleanup.
• The malicious entry is then processed automatically by the Fusion_Form_DB_Privacy shutdown-hook routine, leading to deletion of targeted files (potentially wp-config.php), which can enable remote code execution.

Exploitation/availability signals:

• Press attention indicates exploitation in the wild (itw).
• CISA KEV lists: no (not yet in the Known Exploited Vulnerabilities catalog).
• Public exploit available: no.
• Nuclei detection template exists: no.

About EPSS/KEV: EPSS is an “likelihood of exploitation” score and KEV is CISA’s maintained list of confirmed exploited vulnerabilities. Here, KEV inclusion is not yet known (“no”), but exploitation is still indicated by press reporting.