What the vulnerability does
01Description
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.
Explanation of Vulnerability in Simple Terms
02Summary
Avada (Fusion) Builder versions up to 3.15.1 contain a code injection vulnerability that allows authenticated users with low privileges to inject and execute arbitrary code. An attacker can read sensitive data or modify site content without requiring user interaction. The vulnerability affects the builder's handling of user-supplied input.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code to read sensitive data or modify site content.
Potential impact on your site
04Site Impact
Compromised user accounts can inject malicious code affecting site data and visitor experience.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
April 15, 2026
CVE published
April 15, 2026
Record updated
