CVE-2026-97471: medium-severity vulnerability in themefusion Avada (Fusion) Builder
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
themefusion · Avada (Fusion) BuilderRelated CVEs — themefusion Avada (Fusion) Builder
In the same product, most dangerous first.
CVE-2026-6279CRITICALAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX HandlerEPSS 9.9%CVE-2026-8713CRITICALAvada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry ValueEPSS 3.0%CVE-2026-18431CRITICALAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 0.9%CVE-2024-13345HIGHAvada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2026-4798HIGHAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' ParameterEPSS 0.5%CVE-2026-4782MEDIUMAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode ParameterEPSS 0.5%