CVE-2026-97670

Executive Summary

CVE-2026-97670 is a critical authorization bypass in the Avada (Fusion) Builder plugin for WordPress affecting all versions up to and including 7.16.1. The plugin fails to properly verify authorization before dispatching a WordPress action hook whose name is supplied by an attacker via form-field input, allowing unauthenticated attackers to invoke arbitrary WordPress action hooks. Successful exploitation can cause state changes ranging from denial of service to permanent, irreversible destruction of site content — including permanent deletion of trashed posts, pages, and comments.

Technical Analysis

The vulnerability resides in the dynamic-data pipeline of the Avada (Fusion) Builder plugin. WordPress action hooks are dispatched by name, and the plugin constructs the hook name from attacker-controlled form-field data rather than a fixed, server-side allowlist of permitted hooks. Two specific input vectors are identified in the NVD description:

1. The notification email_message [field] placeholder — when an administrator configures a form notification whose email message template contains an [all_fields] or explicit [field] placeholder.
2. The {action_hook,...} dynamic-data token.

The trust gate intended to contain this behavior, referred to as is_content_request_supplied(), only inspects $_POST['args'] and $_GET['args']. It never inspects $_POST['formData'], which is the payload the public form-submit endpoint actually parses. This mismatch means the authorization/trust check evaluates a different input surface than the one used to build the action hook name, so an attacker can bypass the gate entirely.

The result is that unauthenticated attackers can invoke arbitrary WordPress action hooks — multiple per request. Because hooks are extensible and execute registered callbacks, the impact depends on which hooks are registered and whether they are deny-listed. The description confirms that at minimum core hooks with destructive side effects are reachable. In particular, exploiting wp_scheduled_delete causes permanent deletion of trashed posts, pages, and comments. Other non-deny-listed hooks extend the impact to denial of service, for example wp_maybe_auto_update. Where vulnerable third-party handlers are installed, further privileged writes are possible. The same unauthenticated dynamic-data pipeline also exposes a blind arbitrary user/post-meta read; the read result is delivered only to the site owner and is not attacker-exfiltrable through the plugin's own email/response paths.

Two preconditions are stated: a published Avada form with AJAX submission, and a notification whose email_message template includes an [all_fields] or explicit [field] placeholder. Note that the plugin version referenced as 7.16.1 and the internal reference to a "3.16.1 trust gate" appear in the supplied description; the affected product version boundary is 7.16.1.

The root cause maps to CWE-94 (Improper Control of Generation of Code / Code Injection) in that attacker-influenced data controls the identity of a dispatched executable action — effectively allowing invocation of server-side behavior the attacker should not be authorized to select.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (authorization bypass via attacker-controlled action-hook name) and the mechanics stated in the NVD description.

1. Reconnaissance / target identification: The attacker identifies WordPress sites running the Avada (Fusion) Builder plugin at or below version 7.16.1 that expose a published Avada form configured with AJAX submission. The presence of the plugin and its version may be inferred from publicly served plugin assets and front-end markup.

2. Precondition confirmation: The attacker determines that the site has a notification whose email_message template includes an [all_fields] or explicit [field] placeholder. The planted {action_hook,...} dynamic-data token must be processable through this template so the trust gate — which only checks $_POST['args'] / $_GET['args'] — is not consulted for the $_POST['formData'] channel the public form-submit endpoint parses.

3. Triggering the flaw: The attacker submits the public form with attacker-supplied values in $_POST['formData'] (and the notification field data) crafted so that the plugin builds and dispatches an arbitrary WordPress action hook name. Because the trust gate never inspects formData, the check is bypassed. Multiple hooks may be invoked in a single request.

4. Payload / execution at the vulnerability-class level: Rather than executing arbitrary code directly, the attacker selects the name of a registered WordPress action hook; the plugin dispatches it, invoking whatever callbacks are registered for that hook. Selecting wp_scheduled_delete causes permanent deletion of trashed posts, pages, and comments. Other non-deny-listed hooks (for example wp_maybe_auto_update) extend impact toward denial of service, and where vulnerable third-party handlers are registered, further privileged writes may result.

5. Post-exploitation impact: Successful exploitation yields irreversible destruction of site content, potential denial-of-service conditions, and, conditionally, privileged write operations via third-party handlers. Separately, the same unauthenticated dynamic-data pipeline exposes a blind arbitrary user/post-meta read whose result is delivered only to the site owner — not exfiltrable by the attacker through the plugin's own email/response paths.

Impact Assessment

CVSS v3.1 base score 9.1 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Network-exploitable, low attack complexity, no privileges required, no user interaction required. Confidentiality impact is None (the associated blind read is delivered only to the site owner and is not attacker-exfiltrable through the plugin's own paths). Integrity impact is High and Availability impact is High, consistent with permanent deletion of site content and denial-of-service conditions.

Blast radius: any WordPress site running Avada (Fusion) Builder with a published AJAX-submitted form and a qualifying notification email template. Because no authentication is required and the request targets the public form-submit endpoint, these are remotely and trivially reachable attack surfaces. The most severe confirmed outcome — permanent, irreversible deletion of trashed posts, pages, and comments via wp_scheduled_delete — is a data-destruction event with no recovery path through the plugin. Where vulnerable third-party hook handlers are installed, the blast radius expands to privileged writes. EPSS has not yet been scored for this CVE, so probabilistic exploitation likelihood is currently unknown.

Detection Guidance

Sigma Rule

title: Avada (Fusion) Builder Unauthenticated Arbitrary WordPress Action Hook Dispatch (CVE-2026-97670)
id: 9f2b6c1e-4a7d-4e2a-9c3b-avada97670001
status: experimental
description: Detects POST requests to the Avada public form-submit endpoint carrying attacker-controlled formData that references WordPress action hooks, indicative of CVE-2026-97670 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97670
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_endpoint:
    cs-uri-query|contains:
      - 'action='
  selection_body:
    cs-body|contains:
      - 'formData'
      - 'action_hook'
  selection_hooks:
    cs-body|contains:
      - 'wp_scheduled_delete'
      - 'wp_maybe_auto_update'
      - 'action_hook,'
  condition: selection_method and selection_endpoint and selection_body
falsepositives:
  - Legitimate Avada form submissions containing field names that happen to match keywords
level: high
tags:
  - attack.t1190
  - cve.2026-97670

YARA Rule

rule CVE_2026_97670_Avada_Action_Hook_Injection
{
    meta:
        description = "Detects Avada (Fusion) Builder dynamic-data action_hook token usage in request/body artifacts and web logs related to CVE-2026-97670"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97670"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $a = "{action_hook,"
        $b = "wp_scheduled_delete" ascii nocase
        $c = "wp_maybe_auto_update" ascii nocase
        $d = "formData" ascii nocase
        $e = "email_message" ascii nocase
        $f = "fusion-builder" ascii nocase
    condition:
        uint16(0) == 0x0a0d and
        ( $a or ( $d and ( $b or $c ) ) ) and
        ( $e or $f )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97670 Avada Builder Unauthenticated Action Hook Dispatch Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; http.request_body; content:"formData"; http.request_body; content:"action_hook"; http.request_body; pcre:"/(wp_scheduled_delete|wp_maybe_auto_update)/Ri"; reference:cve,2026-97670; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97670; classtype:web-application-attack; sid:9767001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-97670 Avada Builder Dynamic Data action_hook Token Observed"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"{action_hook,"; nocase; reference:cve,2026-97670; classtype:web-application-attack; sid:9767002; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "network_flow" and http.request.method == "POST" and url.path contains "admin-ajax.php" and http.request.body contains "formData" ]
  [ network where event.action == "network_flow" and http.request.body contains "action_hook" or http.request.body contains "wp_scheduled_delete" ]

Note: EQL field names depend on the ingestion pipeline (Packetbeat/Filebeat); adjust http.request.body and url.path to the deployed schema. The rule correlates an Avada AJAX form POST carrying formData with a subsequent request body containing a dynamic-data action-hook token.

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| eval reqbody = coalesce(form_data, http_request_body, request_body, body, "")
| where (method="POST" OR http_method="POST")
| where match(uri_path, "admin-ajax\.php") OR match(uri_path, "fusion")
| where like(reqbody, "%formData%") AND (like(reqbody, "%action_hook%") OR like(reqbody, "%wp_scheduled_delete%") OR like(reqbody, "%wp_maybe_auto_update%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips by host, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,avada,">
  <rule id="976700" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <method>POST</method>
    <url>admin-ajax.php</url>
    <regex type="pcre2">formData.*(action_hook|wp_scheduled_delete|wp_maybe_auto_update)</regex>
    <description>CVE-2026-97670: Possible unauthenticated Avada Builder arbitrary action hook dispatch</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97670,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Disable or unpublish Avada forms and remove AJAX form submission until a fixed release is available. Exploitation requires a published Avada form with AJAX submission and a notification whose email_message template includes an [all_fields] or explicit [field] placeholder; removing either precondition reduces exposure.
• Remove the {action_hook,...} dynamic-data token and [all_fields]/[field] placeholders from notification email_message templates.
• Restrict access to the public form-submit endpoint at the WAF/reverse-proxy layer, blocking requests whose POST bodies contain formData together with action_hook tokens or wp_scheduled_delete/wp_maybe_auto_update hook names.
• Reduce blast radius by disabling untrusted third-party plugins that register action-hook handlers reachable through the plugin's dispatch path.
• Maintain verified, offline backups so that content deleted via wp_scheduled_delete can be restored, since that action is irreversible through the plugin.

2. Patch/upgrade steps:

• No vendor patch is currently identified for CVE-2026-97670 (all versions up to and including 7.16.1 affected). Monitor the vendor for an updated release and apply it as soon as it is published.
• Until a fix exists, strongly consider disabling the affected plugin where it is not operationally required.

3. Long-term hardening:

• Enforce server-side allowlisting of dispatchable action hooks — hook names must be selected from a fixed, trusted set and never derived from attacker-supplied form fields.
• Ensure security trust gates validate the same input surface actually parsed by the request handler (in this case $_POST['formData']), not only alternate parameters such as $_POST['args']/$_GET['args'].
• Apply least-privilege and explicit deny-listing for destructive core hooks, and review third-party hook handlers for privileged side effects.
• Deploy and tune the detection rules above, and monitor web logs for POST requests to the Avada form-submit endpoint carrying dynamic-data action-hook tokens.

References

• NVD — CVE-2026-97670: https://nvd.nist.gov/vuln/detail/CVE-2026-97670
• MITRE CWE-94 — Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97670 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available for CVE-2026-97670, and no exploit-in-the-wild evidence or threat-actor campaign is associated with this CVE at the time of writing.