# CVE-2026-8713: ThemeFusion Avada Builder arbitrary file deletion via path traversal

Source: https://junglewise.ai/threats/cve-2026-8713-themefusion-avada-builder-arbitrary-file-deletion-via-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-8713 · Severity: critical · CVSS 9.1 · Published 2026-06-19

The Avada (Fusion) Builder plugin for WordPress, a popular tool for designing websites, contains a security flaw that allows anyone on the internet to delete files from the web server. By deleting critical system files like the WordPress configuration file, an attacker can take full control of the website or cause a complete service outage. This attack can be performed without any login credentials or interaction from a site administrator.

Technologies: [ThemeFusion Avada Builder](https://junglewise.ai/threats/technologies/avada-builder). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-8713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8713 being exploited in the wild.

**How severe is CVE-2026-8713?** Critical severity, with a CVSS score of 9.1, published 19 June 2026.

**Which products and versions are affected?** ThemeFusion Avada (Fusion) Builder up to and including 3.15.3.

**Is there a fix for CVE-2026-8713?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8713?** Check whether you run ThemeFusion Avada Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw located in the 'maybe_delete_files' function of the Avada (Fusion) Builder plugin. It stems from insufficient validation of file paths when processing form submissions via the 'wp_ajax_nopriv_fusion_form_submit_ajax' handler. An unauthenticated attacker can submit a crafted payload while manipulating the 'fusion_privacy_expiration_interval' and 'privacy_expiration_action' fields to trigger an immediate cleanup routine. This causes the 'Fusion_Form_DB_Privacy' shutdown hook to delete files specified in the traversal payload. Deleting sensitive files like 'wp-config.php' can lead to remote code execution. The vulnerability affects all versions up to and including 3.15.3.

## Affected products

- ThemeFusion Avada (Fusion) Builder up to and including 3.15.3

## Timeline

- 2026-06-19: disclosed
- 2026-06-19: advisory

## References

- [https://plugins.trac.wordpress.org/browser/fusion-builder/trunk/inc/class-fusion-form-db-entries.php](https://plugins.trac.wordpress.org/browser/fusion-builder/trunk/inc/class-fusion-form-db-entries.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bfb72e-023b-4bfd-b125-91f6ac2f200f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bfb72e-023b-4bfd-b125-91f6ac2f200f?source=cve)

## Related threats

- [ThemeFusion Avada Builder stored XSS in Module Title parameter](https://junglewise.ai/threats/cve-2026-12536-themefusion-avada-builder-stored-xss-in-module-title-parameter)
- [ThemeFusion Avada Builder RCE via PHP Function Injection](https://junglewise.ai/threats/cve-2026-6279-themefusion-avada-builder-rce-via-php-function-injection)
- [ThemeFusion Avada Builder Stored XSS in Shortcodes](https://junglewise.ai/threats/cve-2026-1543-themefusion-avada-builder-stored-xss-in-shortcodes)
- [ThemeFusion Avada Builder SQL injection in product_order parameter](https://junglewise.ai/threats/cve-2026-4798-themefusion-avada-builder-sql-injection-in-product-order-parameter)
- [Avada Builder arbitrary file read in fusion_get_svg_from_file](https://junglewise.ai/threats/cve-2026-4782-avada-builder-arbitrary-file-read-in-fusion-get-svg-from-file)