CVE-2026-8713: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

Synopsis

An arbitrary file deletion vulnerability exists in the Avada (Fusion) Builder WordPress plugin (versions up to and including 3.15.3). The flaw is reachable over the network with no authentication required, and no action from a victim is needed; an attacker submits a path-traversal payload through a public AJAX handler that the plugin exposes for unauthenticated form submissions. Successful exploitation lets an attacker delete arbitrary files on the server, including wp-config.php, which removes the installation's secret keys and database credentials and is a well-known stepping stone to full remote code execution. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX handler (wp_ajax_nopriv_fusion_form_submit_ajax) is exposed over HTTP/HTTPS, so the attacker must be able to reach the WordPress site across the network.

• AuthenticationNot required

  The handler is registered under wp_ajax_nopriv, meaning no WordPress account or session of any privilege level is needed to submit the malicious payload.

• Victim interactionNot required

  The attack is fully self-contained: the attacker submits the path-traversal form entry and forces immediate cleanup via the same request chain, with no administrator or user action required.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a published Avada form with database entry saving is present; no race condition, memory layout knowledge, or environmental guesswork is required.

Blast Radius

• Deletes arbitrary files from the server filesystem, including application source files, configuration files, and credentials.
• Deletes wp-config.php, which exposes database credentials and authentication secret keys stored in that file and removes the integrity anchor WordPress uses on restart.
• Triggers remote code execution by removing files that gate access controls or by forcing WordPress into its reinstallation flow, which an attacker can intercept to install a malicious configuration.
• Crashes or permanently disables the WordPress site by deleting core files, producing a denial-of-service condition for all site visitors.