CVE-2026-97670
Avada (Fusion) Builder92/100
confirmed exploited
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], n
Listed in VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.004 (probability of exploitation) · CVSS base 9.1
Public PoC / Exploit
No public PoC/exploit references indexed yet. Newly-disclosed CVEs often have none — exploit publication lags disclosure.
References2