Avada flaw lets logged-out visitors delete trashed content

On 9 October 2026 Wordfence disclosed a critical vulnerability in Avada Builder, one of the two plugins the Avada theme requires (CVE-2026-97670). Through a public form on the site, a visitor without an account can make WordPress run an internal action of their choosing. In Wordfence's test, one such request permanently deleted posts, pages and comments from the trash. Avada Builder versions up to and including 3.16.1 are affected. The fix is in version 3.16.2, which ThemeFusion released with Avada 7.16.2 on 30 September, nine days before Wordfence went public.

How the Avada Builder vulnerability works

WordPress and its plugins do much of their work through internal actions (action hooks), such as clearing out the trash or running automatic updates. Avada forms can send an email on every submission and put the field values into it. According to Wordfence, the attacker types an Avada dynamic data token ({action_hook}) into a form field, and Avada fires the action it names without checking whether the visitor is allowed to. One request can carry several such actions.

Wordfence's example is wp_scheduled_delete, the action WordPress uses to clear out the trash. According to the WordPress documentation, it permanently deletes whatever has sat in the trash longer than the set period, 30 days by default. The attacker chooses the action, though. Wordfence writes that other actions can take the site down, and that where plugins with vulnerable handlers for such actions are installed, the attacker can make changes that would otherwise need a login with the right permissions. The vulnerability scores 9.1 on the CVSS scale, which puts it in the "critical" band.

Are you affected?

You are affected if your site runs Avada Builder up to and including version 3.16.1. The CVE record gives the range as "up to 7.16.1", which is the Avada theme's version number. The plugin has its own numbering, so check the Avada Builder version in Plugins > Installed Plugins. In cPanel's Terminal, the two commands below show the versions of the theme and the plugins. The WP-CLI guide explains how to work with WP-CLI.

# cPanel > Terminal, in the site's folder
# Read-only. Shows the versions of the Avada theme and plugins.
wp theme list --fields=name,status,version | grep -i avada
wp plugin list --fields=name,title,status,version \
  | grep -iE "avada|fusion"

If the theme is on 7.16.2 but Avada Builder is older than 3.16.2, the update is not finished, because the plugins are updated separately from the theme.

According to Wordfence, the attack also needs a published Avada form that is submitted through AJAX (without reloading the page) and sends an email notification. The email message has to contain [all_fields] or a field name in square brackets. Wordfence says this is the default setting, and ThemeFusion's documentation says notifications are only sent at all when a form is submitted through AJAX. So assume the condition is met for every published Avada form that emails you its submissions. The forms are under Avada > Forms, and their notifications are on the Notifications tab of the Form Options. If the site has no such form, the condition is not met, but update anyway.

If your forms also save submissions to the database (Form Entries), search them for the text action_hook. A visitor has no reason to type it, so such an entry is a trace of an attempted attack. Finding nothing does not prove there was no attempt.

What to do

1. Back up the files and the database, as described in the backup guide. ThemeFusion also recommends a full backup before every update.
2. Update the Avada theme to 7.16.2 or later. According to ThemeFusion, the update appears in Dashboard > Updates once Avada is registered with its purchase code. Without registration the theme is updated by hand with the files from ThemeForest, following ThemeFusion's instructions.
3. Update the Avada Core and Avada Builder plugins, Avada Core first. After the theme update the admin shows a notice for them. If it does not, you will find them under Avada > Maintenance > Plugins & Add-Ons. Then check that Avada Builder is on 3.16.2 or later.
4. If you cannot update right away, set the Avada forms that send notifications to Draft until you can. According to Wordfence, the attack needs a published form.

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update before anyone exploits it, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.

Sources

• Wordfence, Avada (Fusion) Builder vulnerability
• NVD, CVE-2026-97670
• ThemeFusion, Version 7.16.2 Security Update
• ThemeFusion, Avada Changelog
• ThemeFusion, Plugin Installation & Maintenance
• ThemeFusion, Important Update Info
• ThemeFusion, How To Update The Avada Website Builder
• ThemeFusion, How To Register Avada
• ThemeFusion, Avada Form Options
• WordPress Developer Resources, wp_scheduled_delete()