Security Alert Summary
The Avada (Fusion) Builder plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to trigger arbitrary WordPress action hooks via the plugin’s Dynamic Data feature. The issue stems from a function that accepts user-controlled input to invoke registered action hooks without performing proper authorization checks, which can lead to privilege escalation, file inclusion, denial of service, or other impacts depending on available hooks.
CVE Details
- CVE ID: CVE-2026-1509
- Affected component: Avada (Fusion) Builder plugin for WordPress
- Affected versions: All versions up to and including 3.15.1
- Published: April 15, 2026 at 4:17:33 AM
- Last modified: April 15, 2026 at 4:17:33 AM
- CVSS v3.1: Base Score 5.4, MEDIUM — Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Authentication / Privileges / User Interaction: Requires authentication; privileges required: LOW (Subscriber-level and above); user interaction: NONE
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-94
Technical Details
This vulnerability exists because the plugin’s output_action_hook() function accepts user-controlled input and uses it to trigger any registered WordPress action hook without performing proper authorization checks. The entry point for this behavior is the plugin’s Dynamic Data feature, which allows user-supplied values to influence which action hooks are executed.
Because output_action_hook() does not validate or restrict which hooks can be invoked, an authenticated user with Subscriber-level access or higher can cause arbitrary action hooks registered in the WordPress installation to run. The exact impact depends on which hooks are present and what those hooks do in the context of the site (for example, plugins or themes that attach privileged operations to certain hooks).
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff who have Editor or Author roles, and external contributors or contractors granted Subscriber or Contributor accounts for content. An authenticated attacker who gains or controls a Subscriber account could use the Dynamic Data feature to invoke action hooks that are otherwise only expected to run in trusted contexts. This may enable privilege escalation within the application, trigger code paths that lead to file inclusion, or cause denial-of-service conditions depending on the hooked functions.
Practical consequences include increased risk of unauthorized changes to content or metadata, exposure of internal user email addresses if hooks reveal user data, and an elevated risk of targeted phishing or social engineering against staff based on leaked information. The vulnerability does not necessarily imply complete site takeover, but it does increase risk in environments where sensitive hooks are present.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and subscribers who do not need editing capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior related to action hook execution or unexpected changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
