On 13 October 2026 Wordfence disclosed a new vulnerability in Avada Builder, the plugin that builds the pages of the Avada theme (CVE-2026-97471). A visitor without an account can read the administrator's email address and login name and, on a WooCommerce store, customers' billing details. Avada Builder versions up to and including 3.16.1 are affected. The CVE record points to ThemeFusion's notes for Avada 7.16.2, released on 30 September, which list a fix for a possible information exposure in the Instagram element.
That is the same update that closed the trash deletion flaw. If you updated then and Avada Builder is already on 3.16.2, there is nothing more to do.
What customer data can leak
According to the record, an attacker can pull arbitrary profile data (user meta) for any user by giving the user's ID. It names the administrator's email address and login name, and the billing email, phone number and address that WooCommerce keeps for customers with an account on the store.
With that, an attacker can send a customer a convincing text message, for example saying a parcel from Econt or Speedy is waiting for an extra payment, with a link to a fake payment page. With the administrator's login name in hand, only the password is left to guess. And a customer's email, phone and address are personal data protected by the GDPR, which you are responsible for as the store owner.
The vulnerability scores 5.3 on the CVSS scale, "medium", because it only lets the attacker read data, not change the site. The CVSS score guide explains what such a score means. As of 15 October, CISA notes in the record that there is no evidence of attacks using this vulnerability.
Is your site affected?
It is if Avada Builder is on version 3.16.1 or older. The plugin has its own version numbers, separate from the theme's. You can see the version in Plugins > Installed Plugins, and in cPanel's Terminal the two commands below show the Avada theme and plugins. The WP-CLI guide explains how to work with WP-CLI.
# cPanel > Terminal, in the site's folder
# Read-only. Shows the versions of the Avada theme and plugins.
wp theme list --fields=name,status,version | grep -i avada
wp plugin list --fields=name,title,status,version \
| grep -iE "avada|fusion"
The attacker's request also needs a security token (a nonce). According to the CVE record, this token appears in plain text in the code of any page with Avada's Instagram element, which shows posts from Instagram on the site. So sites that use this element are the most exposed. The record does not say whether the token can be obtained another way, so update even if you do not use it.
What to do
- Back up the files and the database, as described in the backup guide.
- Update the Avada theme to 7.16.2 or later, then the Avada Core and Avada Builder plugins, Avada Core first. If the theme is registered with its purchase code, the update is in
Dashboard > Updates. If it is not, follow ThemeFusion's instructions. Then check the Avada Builder version. It should be 3.16.2 (the current one, according to ThemeFusion) or later. - Make sure the administrators use strong passwords they do not use anywhere else. The WordPress security guide shows how to protect the admin login.
- If you cannot update right away, remove the Instagram element from your pages until you can. That takes away the place where, according to the record, the token is visible. It only makes the attack harder and does not replace the update.
What we do
With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.
Frequently asked questions
What is CVE-2026-97471 in Avada Builder?
A vulnerability in Avada Builder, the plugin the Avada theme uses to build pages, disclosed by Wordfence on 13 October 2026. A visitor without an account can read the administrator's email address and login name and, on a WooCommerce store, customers' billing details. Avada Builder versions up to and including 3.16.1 are affected.
Which customer data can leak through Avada Builder?
According to the CVE record, an attacker can pull arbitrary profile data for any user by giving the user's ID. The record names the administrator's email address and login name, and the billing email, phone number and address that WooCommerce keeps for customers with an account. These are personal data protected by the GDPR, and as the store owner you are responsible for them.
Is a vulnerability scored 5.3 dangerous?
A CVSS score of 5.3 is "medium", because the Avada Builder flaw only lets the attacker read data, not change the site. With a customer's email and phone, though, someone can send a convincing message saying a parcel from Econt or Speedy is waiting for an extra payment, with a link to a fake payment page. And with the administrator's login name, only the password is left to guess.
Which version of Avada Builder fixes CVE-2026-97471?
Avada Builder 3.16.2, which ThemeFusion released with the Avada 7.16.2 theme on 30 September 2026. The notes for Avada 7.16.2 list a fix for a possible information exposure in the Instagram element.
I updated Avada for the trash deletion flaw, do I need to do anything else?
Not if Avada Builder is already on 3.16.2. The same Avada 7.16.2 update closed both the flaw that deletes content from the trash and the data exposure in CVE-2026-97471. Check the plugin version under Plugins > Installed Plugins, since it is separate from the theme's version.
Why does Avada's Instagram element make a site more exposed?
The attacker's request needs a security token (a nonce). According to the CVE record, that token appears in plain text in the code of any page with Avada's Instagram element, which shows Instagram posts on the site. The record does not say whether the token can be obtained another way, so update even if you do not use the element.
What if I cannot update Avada right away?
Remove Avada's Instagram element from your pages until you can update. That takes away the place where, according to the record, the token is visible. It only makes the attack harder and does not replace the update to Avada Builder 3.16.2.
Is CVE-2026-97471 being exploited?
As of 15 October 2026, CISA notes in the record that there is no evidence of attacks using this Avada Builder vulnerability. That is no reason to put off the update, and administrators should use strong passwords they do not use anywhere else.