PT-2026-32995 · WordPress · Avada Builder

Craig Smith · Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-1541

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder versions prior to 3.15.2

Description The plugin contains a sensitive information exposure issue. The fusion get post custom field() function does not validate if metadata keys are protected by an underscore prefix. This allows authenticated attackers with Subscriber-level access or higher to extract protected post metadata fields through the post custom field parameter of the Dynamic Data feature.

Recommendations Update to a version newer than 3.15.1.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1541

Affected Products

Avada Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1541 · Security Note
• https://twitter.com/CVEnew/status/2044338851993587873 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f1f69f93-80e3-434d-98a6-fc8757b4e6d1?source=cve · Note
• https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 · Note