Arbitrary Action Execution Vulnerability in Avada Builder Plugin for WordPress

CVE-2026-1509

What is CVE-2026-1509?

The Avada Builder plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to execute arbitrary WordPress action hooks. This occurs through the use of the output_action_hook() function, which processes user-controlled input but lacks sufficient authorization checks. Consequently, attackers can leverage this flaw to initiate various actions in WordPress, potentially resulting in privilege escalation, unauthorized file inclusion, denial of service, or other detrimental consequences based on available registered action hooks.

References