CVE-2026-97471

Deferred Deferred - Pending Action

Sensitive Information Exposure in Avada Builder WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97471

EUVD

EUVD-2026-100799

Affected Vendors & Products

Vendor	Product	Version / Range
themefusion	Avada	(Fusion) Builder 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in the Avada (Fusion) Builder WordPress plugin allows unauthenticated attackers to access sensitive user data. It occurs due to improper handling of the 'args[link_target]' parameter, which exposes arbitrary user meta values like email addresses, login names, and WooCommerce customer details such as billing information.

Detection Guidance

Check WordPress sites for the Avada (Fusion) Builder plugin versions up to 3.16.1. Look for exposed user meta data like email addresses or login names via the 'args[link_target]' parameter. Inspect pages with the [fusion_instagram] shortcode for plaintext awb-instagram-nonce values.

Impact Analysis

Attackers can steal personal data including administrator emails, login names, and customer billing details. This may lead to identity theft, phishing attacks, or unauthorized access to accounts if combined with other exploits.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if healthcare-related PII is exposed. Organizations must report breaches and implement stronger protections to maintain compliance.

Mitigation Strategies

Update the Avada (Fusion) Builder plugin to version 3.16.2 or later. Remove or restrict access to pages containing the [fusion_instagram] shortcode until updated. Review user meta data exposure and implement additional access controls.

Hi! I’m here to help you understand CVE-2026-97471. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70