Is CVE-2026-8713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8713 being exploited in the wild.

How severe is CVE-2026-8713?

Critical severity, with a CVSS score of 9.1, published 19 June 2026.

Which products and versions are affected?

ThemeFusion Avada (Fusion) Builder up to and including 3.15.3.

Is there a fix for CVE-2026-8713?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8713 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8713?

Check whether you run ThemeFusion Avada Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8713: ThemeFusion Avada Builder arbitrary file deletion via path traversal

CVE-2026-8713 · Severity: critical · CVSS 9.1 · Published 2026-06-19

The Avada (Fusion) Builder plugin for WordPress, a popular tool for designing websites, contains a security flaw that allows anyone on the internet to delete files from the web server. By deleting critical system files like the WordPress configuration file, an attacker can take full control of the website or cause a complete service outage. This attack can be performed without any login credentials or interaction from a site administrator.

Technologies: ThemeFusion Avada Builder. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-8713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8713 being exploited in the wild.
How severe is CVE-2026-8713?: Critical severity, with a CVSS score of 9.1, published 19 June 2026.
Which products and versions are affected?: ThemeFusion Avada (Fusion) Builder up to and including 3.15.3.
Is there a fix for CVE-2026-8713?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8713 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8713?: Check whether you run ThemeFusion Avada Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw located in the 'maybe_delete_files' function of the Avada (Fusion) Builder plugin. It stems from insufficient validation of file paths when processing form submissions via the 'wp_ajax_nopriv_fusion_form_submit_ajax' handler. An unauthenticated attacker can submit a crafted payload while manipulating the 'fusion_privacy_expiration_interval' and 'privacy_expiration_action' fields to trigger an immediate cleanup routine. This causes the 'Fusion_Form_DB_Privacy' shutdown hook to delete files specified in the traversal payload. Deleting sensitive files like 'wp-config.php' can lead to remote code execution. The vulnerability affects all versions up to and including 3.15.3.

Affected products

ThemeFusion Avada (Fusion) Builder up to and including 3.15.3

Timeline

2026-06-19: disclosed
2026-06-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.