Avada Builder

CVE-2026-97670 is a critical authorization-bypass vulnerability in Avada Builder that lets an unauthenticated visitor invoke WordPress action hooks through a public Avada form. Sites running Avada 7.16.1 or earlier with Avada Builder 3.16.1 or earlier should update the complete Avada package immediately.

Affected versions and severity

• CVE: CVE-2026-97670
• Severity: Critical, CVSS 9.1
• Privileges required: None
• User interaction: None
• Attack class: Authorization bypass / arbitrary WordPress action invocation

How the vulnerability works

The vulnerable Avada Forms path accepts public form data and resolves dynamic-data tokens used in notification fields. The affected authorization gate checks one request location but does not correctly cover the form data parsed by the public submission endpoint. An attacker can therefore influence the action-hook name that Avada dispatches.

The practical impact depends on action handlers registered by WordPress, Avada, and other installed plugins. The disclosure confirms that an unauthenticated request could invoke the WordPress scheduled-deletion hook and permanently remove posts, pages, and comments that were already in Trash. Other reachable hooks can cause additional state changes or denial of service. Administrators should treat this as a site-integrity emergency even though the exact impact varies by installation.

Immediate remediation

1. Take a current database and file backup before changing the Avada package.
2. Update the Avada theme to 7.16.2 or later.
3. Confirm the bundled Avada Builder plugin is 3.16.2 or later; updating only the theme while leaving an old builder plugin active is not sufficient.
4. Purge page, object, and CDN caches after the update.
5. If you cannot update immediately, deactivate Avada Builder and disable public Avada forms until the patched package is installed. A WAF rule is only a temporary compensating control.

Verify installed versions

wp theme get Avada --fields=name,version,status
wp plugin get fusion-builder --fields=name,version,status

If the plugin slug differs on a customized deployment, list active plugins and locate the Avada Builder entry:

wp plugin list --status=active --fields=name,version,status

Compromise checks

• Review Trash and deletion audit logs for unexpected purges of posts, pages, or comments.
• Compare recent database backups for unexplained content loss or modified options.
• Inspect web-server and WAF logs for unusual bursts of anonymous Avada form submissions.
• Review scheduled events and update activity for actions that were not initiated by an administrator.
• Check administrator accounts, active sessions, recently modified plugins, and unexpected files if any suspicious state change is found.

Verification after remediation

1. Confirm Avada 7.16.2+ and Avada Builder 3.16.2+ are active.
2. Submit each legitimate Avada form and verify normal delivery and validation.
3. Re-run malware and file-integrity scans.
4. Keep logs under review for repeated anonymous form requests after patching.

Exploitation status

The authoritative records reviewed for this advisory did not report confirmed exploitation in the wild, and CVE-2026-97670 was not found in the CISA Known Exploited Vulnerabilities catalog at review time. The flaw is remotely reachable without authentication and affects a widely deployed commercial theme ecosystem, so patching should not wait for exploitation reports.

Sources

• Patchstack vulnerability record
• GitHub Advisory Database entry
• NVD record for CVE-2026-97670
• Avada 7.16.2 security update

This advisory is based on disclosures from Wordfence, Patchstack, the CVE Program, and Avada. WPDeeply did not discover this vulnerability.