Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

id: CVE-2026-8713

info:
  name: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion
  author: rool-machine
  severity: critical
  description: |
    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the file_path parameter in the fusion_form_maybe_delete_files AJAX action. Deleting critical files like wp-config.php can lead to complete site takeover via reinstallation. This template detects the vulnerable version via homepage asset URL versioning (primary) and readme.txt Stable tag (fallback).
  impact: |
    An unauthenticated attacker can delete any file readable by the web server process, potentially leading to complete site compromise through wp-config.php deletion and WordPress reinstallation.
  remediation:
    Upgrade the Avada Builder (Fusion Builder) plugin to version 3.15.4 or later.
  reference:
    - https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8713
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2026-8713
    epss-score: 0.00919
    epss-percentile: 0.56592
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"WordPress" http.component:"Avada"
    fofa-query: body="fusion-builder" && body="WordPress"
    product: fusion-builder
    vendor: theme-fusion
    framework: wordpress
  tags: cve,cve2026,wordpress,wp-plugin,avada,fusion-builder,file-deletion,passive,vkev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "fusion-builder"

      - type: dsl
        dsl:
          - compare_versions(version, '<= 3.15.3')

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "fusion-builder/assets/css/media/fullwidth[^\"']*\\?ver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)"
          - "id=['\"]fb-[^'\"]+['\"]\\s+href=['\"][^'\"]*\\?ver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)['\"]"
        internal: true

      - type: regex
        name: detected_version
        part: body
        group: 1
        regex:
          - "fusion-builder/assets/css/media/fullwidth[^\"']*\\?ver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)"
          - "id=['\"]fb-[^'\"]+['\"]\\s+href=['\"][^'\"]*\\?ver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)['\"]"
# digest: 4a0a004730450220353ca62cc4e2876a2bb07c08cec8013606a3fe9543aa7bcb485d743cb0b976c902210082295b1529f40b26028125b56c0bcfc4cd0e6c4de31c8ddcd49a983bfd5bf716:922c64590222798bb761d5b6d8e72950