Sensitive Information Exposure in Avada Builder Plugin for WordPress

CVE-2026-97471

What is CVE-2026-97471?

The Avada (Fusion) Builder plugin for WordPress is impacted by a vulnerability allowing unauthorized access to sensitive user information. An unauthenticated attacker can exploit the 'args[link_target]' parameter to retrieve arbitrary user meta information for any user ID. This includes critical data such as administrator email addresses, login names, and WooCommerce customer personal identifiable information (PII) like billing emails, phone numbers, and addresses. The vulnerability is exacerbated by the awb-instagram-nonce parameter, which is exposed in plaintext within the fusionInstagramVars, making it accessible to anyone visiting the page that uses the [fusion_instagram] shortcode before an exploit is initiated.

References