| Severity | CRITICAL |
| Threat Category | Vulnerability – Authorization Bypass / Code Injection (CWE-94) |
| Affected Platforms | WordPress sites running the Avada (Fusion) Builder plugin, all versions up to and including 7.16.1 |
| CVE | CVE-2026-97670 |
| CVSS | 9.1 CRITICAL |
1. Overview
A critical authorization-bypass vulnerability has been disclosed in Avada (Fusion) Builder, the page-builder plugin bundled with the widely sold Avada WordPress theme by ThemeFusion. Tracked as CVE-2026-97670, the flaw lets an unauthenticated visitor trigger internal WordPress actions on a vulnerable site simply by submitting a public Avada form. The most direct consequence is the permanent, irreversible deletion of content that is sitting in the site’s trash.
ThemeFusion shipped the fix in Avada 7.16.2 on 30 September 2026, listing it among several form-related security hardening items without naming the issue as an authorization bypass. Wordfence, the CVE Numbering Authority, published the vulnerability on 10 October 2026 with a CVSS base score of 9.1. All plugin versions at or below 7.16.1 are affected.
2. Who is Affected
Any WordPress site that uses the Avada theme and has published at least one Avada form with a notification email is affected if the plugin is at version 7.16.1 or older.Avada is a widely used commercial WordPress theme, and it may be used by businesses, media outlets, schools, and individual website owners in Bhutan, potentially exposing a broad range of websites to vulnerabilities affecting the theme. No authentication, account, or user interaction is required to exploit the flaw.
BtCIRT has not received any reports of confirmed exploitation within Bhutan at the time of publication. The severity is nonetheless assessed as CRITICAL for the following reasons:
- Exploitation is fully unauthenticated and needs only a single crafted submission to a public-facing form that already exists on the site.
- The plugin is extremely widely deployed, and the vulnerable configuration, a form with a notification email containing field placeholders, is the default, so a large share of installations are exploitable as shipped.
- Public technical details and the CVE record are now available, which typically precedes automated, opportunistic scanning of exposed WordPress sites.
- The primary impact, permanent deletion of trashed posts, pages, and comments, is irreversible and can also be driven repeatedly to cause denial of service.
3. How the Vulnerability Works
- Stage 1 – Root Cause
Avada forms support dynamic-data tokens that are expanded when a submission is processed, including a token that dispatches a named WordPress action hook. Before firing such an action, the plugin is supposed to confirm the request is a trusted, internal one. The trust check only inspects a specific request field, but the public form-submission endpoint reads its values from a different field. As a result, hook names supplied through the public form are never validated against the trust gate (CWE-94, improper control of code generation).
- Stage 2 – Exploitation
An unauthenticated visitor submits an existing public Avada form and places an action-hook token into the submitted form data. Because the trust check does not look at that field, the plugin treats the request as legitimate and dispatches the attacker-named WordPress action during submission processing. Built-in WordPress actions can be abused this way, including the action that permanently deletes an item currently in the trash.
- Stage 3 – Impact
Firing arbitrary internal actions lets an attacker permanently delete trashed posts, pages, and comments, bypassing the normal safety of the trash. Repeated submissions can be used to degrade or deny service. On sites where other installed plugins register sensitive action hooks, those handlers may also be reachable, potentially allowing unauthorized writes to site or user metadata. There is no direct data exfiltration from this flaw alone.
- Stage 4 – Fix and Disclosure
ThemeFusion corrected the validation logic in Avada 7.16.2, released on 30 September 2026, so that hook-dispatching tokens in public form data are properly gated. Wordfence assigned CVE-2026-97670 and published the advisory on 10 October 2026 with a CVSS score of 9.1. The CVE record was last updated on 11 October 2026.
4. Indicators to Watch For
- The installed Avada plugin is version 7.16.1 or earlier. Check under Appearance then Avada, or in the WordPress Plugins screen, and compare against the fixed release 7.16.2.
- Trashed posts, pages, or comments disappearing permanently with no administrator having emptied the trash.
- Unusual bursts of submissions to Avada forms in server access logs, especially POST requests to the site’s admin-ajax endpoint referencing the Avada form handler from unexpected source addresses.
- Form submission or email-notification log entries that contain action-hook or dynamic-data tokens in user-supplied fields.
- Unexplained changes to post or user metadata on sites that also run other plugins exposing sensitive action hooks.
5. Recommendations
5.1. For organizations and government offices:
- Update the Avada theme and its bundled Fusion Builder plugin to version 7.16.2 or later without delay. This is the single, complete fix.
- Inventory all WordPress sites in your organization and identify any using the Avada theme, including staging and seldom-updated sites, and bring each to the patched version.
- Until patching is complete, consider temporarily unpublishing or restricting public Avada forms, and place the site behind a web application firewall with WordPress rulesets enabled.
- Review form-submission and web-server logs for the indicators in Section 4, and verify that important content has recent, off-site backups so trashed-content deletion can be recovered.
- Keep automatic updates enabled for themes and plugins where feasible, and subscribe to ThemeFusion and WordPress security notifications so future fixes are applied promptly.
5.2 For individuals:
- If you run a personal or small-business site on the Avada theme, update to Avada 7.16.2 or later from your WordPress dashboard now.
- If you cannot update immediately, ask your hosting provider or site maintainer to apply the update, and confirm you have a recent backup of your site content.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt
7. Sources and References
- Wordfence Threat Intelligence – Avada (Fusion) Builder <= 7.16.1 Unauthenticated Authorization Bypass (CVE-2026-97670) (10 October 2026).
https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c00795-c49b-4b0a-8f0a-4ed18c966c6b?source=cve - CVE-2026-97670 – CVE Record (Wordfence CNA) (10 October 2026).
https://www.cve.org/CVERecord?id=CVE-2026-97670 - ThemeFusion – Avada 7.16.2 Security Update (30 September 2026).
https://avada.com/blog/version-7-16-2-security-update/ - NVD – CVE-2026-97670 Detail (11 October 2026).
https://nvd.nist.gov/vuln/detail/CVE-2026-97670