PT-2026-32994 · WordPress · Avada Builder

Craig Smith · Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-1509

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder versions prior to 3.15.2

Description The plugin allows authenticated attackers with Subscriber-level access and above to execute arbitrary WordPress action hooks through the Dynamic Data feature. This occurs because the output action hook() function accepts user-controlled input to trigger registered WordPress action hooks without proper authorization checks. This flaw can lead to privilege escalation, file inclusion, or denial of service, depending on the available action hooks in the WordPress installation.

Recommendations Update to a version newer than 3.15.1.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-1509

Affected Products

Avada Builder

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1509 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=cve · Note
• https://twitter.com/CVEnew/status/2044338850793959530 · Twitter Post
• https://avada.com/documentation/avada-changelog · Note
• https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 · Note