Executive brief
The Avada (Fusion) Builder plugin for WordPress, a popular tool for designing websites, contains a security flaw that allows anyone on the internet to delete files from the web server. By deleting critical system files like the WordPress configuration file, an attacker can take full control of the website or cause a complete service outage. This attack can be performed without any login credentials or interaction from a site administrator.
Technical details
The vulnerability is a path traversal flaw located in the 'maybe_delete_files' function of the Avada (Fusion) Builder plugin. It stems from insufficient validation of file paths when processing form submissions via the 'wp_ajax_nopriv_fusion_form_submit_ajax' handler. An unauthenticated attacker can submit a crafted payload while manipulating the 'fusion_privacy_expiration_interval' and 'privacy_expiration_action' fields to trigger an immediate cleanup routine. This causes the 'Fusion_Form_DB_Privacy' shutdown hook to delete files specified in the traversal payload. Deleting sensitive files like 'wp-config.php' can lead to remote code execution. The vulnerability affects all versions up to and including 3.15.3.
Affected products
- ThemeFusion Avada (Fusion) Builder up to and including 3.15.3
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory