blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-1509

MEDIUM 5.4 CVSS 3.1
Published
April 15, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-94
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.

Affected products and versions

  • themefusion Avada (Fusion) Builder — Up to and including 3.15.1

References

  • avada.com https://avada.com/documentation/avada-changelog/
  • themeforest.net https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=cve
  • nvd.nist.gov Official NVD record