Authorization Bypass in Avada Builder Plugin for WordPress

CVE-2026-97670

What is CVE-2026-97670?

The Avada Builder plugin for WordPress suffers from a critical authorization bypass vulnerability. This flaw exists in all versions up to and including 7.16.1, where the plugin inadequately verifies authorization before executing certain WordPress action hooks. Specifically, an attacker can manipulate the form-field values, thanks to the plugin's reliance on user-supplied data for executing actions. As a result, unauthorized users can trigger action hooks that may lead to significant alterations of site content. For instance, exploiting this vulnerability could allow attackers to permanently delete posts, pages, and comments, causing irreversible damage to websites. The potential for denial of service is also present, along with unauthorized privileged actions if vulnerable third-party handlers are available. Additionally, attackers may leverage the same pipeline for unauthorized access to user/post metadata, although the results are directed only to the site owner, making direct exfiltration difficult. This vulnerability is particularly concerning as it requires only the presence of a published Avada form with specific AJAX submissions, coupled with improperly configured notification email templates.

References