A stranger fills in your contact form. Your WordPress trash is suddenly empty. Trashed pages, posts and comments – permanently deleted, with no undo button inside WordPress. That’s the verified impact of this Avada Builder vulnerability. The stranger doesn’t need an account or a password.
It sounds oddly specific. It is. But if you’ve been treating the trash as a place to keep old landing pages or content you might need later, this is a nasty reminder that it isn’t storage. Let’s check what’s affected and what you can do today.
Which Avada versions are affected?
The issue is in Avada Builder, the ThemeFusion plugin bundled with the Avada theme. Its plugin slug is fusion-builder, and it used to be called Fusion Builder. So if you spot that older name while checking your site, you’re looking in the right place.
- Affected: Avada Builder 3.16.1 and older, including the builder bundled with Avada 7.16.1.
- Fixed: Avada Builder 3.16.2, bundled with Avada 7.16.2. Update both the theme and its bundled builder plugin.
- Severity: CVE-2026-97670, rated 9.1 (critical) on the CVSS scale. The issue is unauthenticated – no login is needed.
Wordfence researcher Chloe Chamberland found the issue. Patchstack listed it on October 9, 2026, and the CVE was published on October 10, 2026. The version that matters on your site is the plugin version: check that your plugins list shows Avada Builder 3.16.2 or later. If you’re unsure which theme and builder are active, our vulnerability scanner checks active plugins and the theme.
How can a form submission empty the trash?
You don’t have to understand WordPress hooks to understand the mistake. A form field that should have been treated as a visitor’s text could instead make WordPress run an action chosen by that visitor.
- Your site has a published Avada form that submits over AJAX, with a notification email containing a field placeholder. The default email setup uses
[all_fields], so a standard form may meet these conditions. - A visitor puts a specially shaped dynamic-data token, such as
{action_hook,...}, into a form field and submits it. - While processing the submission and its notification, Avada Builder interprets that token. It can fire the WordPress action hook named in the token, several times in one request.
- The permission check examines
args, but the submitted content it needs to check is informData. It’s checking the wrong part of the request. - In the verified example, one unauthenticated request fired
wp_scheduled_delete, the WordPress action that permanently clears trashed posts, pages and comments.
There’s no need to click a strange link in an email to trigger that example. The vulnerable processing happens when the form is submitted. And since the form is public, the person submitting it doesn’t have to be someone you know.
Why “only the trash” is a big deal
Owners use the trash as a makeshift archive all the time. Last season’s landing page gets parked there. A draft you’re not quite ready to throw away sits beside spam comments and removed products. You may intend to tidy it up later. Maybe you won’t. Either way, “trash” can still contain work you’d hate to recreate.
WordPress offers no undo after those trashed posts, pages and comments are permanently deleted. A backup may let you recover them, but only if it contains the right data and you can actually restore it. Trash is definately not a backup. If you’re relying on backups for this, read why having a backup isn’t the same as having a recovery plan.
The trash-clearing action is the concrete, verified example, not a ceiling on what the bug can do. Other hooks can cause denial of service, such as wp_maybe_auto_update. Some vulnerable third-party plugins can also make more privileged writes possible. There’s a blind meta read too, although its result goes only to the site owner’s email.
Patchstack labels the entry “Arbitrary Code Execution” in its database. Labels differ; the described and verified behavior here is arbitrary action invocation, not someone uploading code and running it. I’d rather be precise about that than make the headline scarier than the evidence.
What to do today: a short checklist
Start with the version check. Then deal with any forms that could expose the bug while you arrange the update.
- Update Avada and Avada Builder. Aim for Avada 7.16.2 and Avada Builder 3.16.2 or later. Avada handles updates for its bundled plugins through its own dashboard or plugins screen; don’t assume updating the theme has updated the builder. Confirm the builder version in your plugins list afterward. If you’re worried about disrupting a live shop, use this guide to updating WordPress, plugins and themes safely before you start.
- Can’t update right now? Turn off AJAX submission on your Avada forms or unpublish those forms. Another option is removing field placeholders, including
[all_fields], from their notification emails. Check each published form rather than assuming they all share one setting. - Save what you still need from the trash. Restore important items now, or back them up. Then check that your site backups exist off-site and test a restore. A backup you’ve never tried to restore is a fairly bold bet.
- Look for odd submissions. If you keep form entries or notification emails, search them for unexpected curly-brace tokens. Finding one is a reason to investigate, not proof by itself that your trash was wiped.
Are attackers using it already?
There’s no confirmed active exploitation reported as of now, and this CVE isn’t in CISA KEV. Patchstack expects exploitation in mass campaigns, though. That’s a reason to patch promptly, not a reason to claim an attack has already happened to your site.
Don’t forget the bundled plugin
Premium themes don’t update from wordpress.org like ordinary plugins, and it’s easy to check the theme version while missing the builder bundled with it. That gap is exactly what I’d look for first here. If you’d rather have someone keep track of those paired updates, our WordPress maintenance service covers that routine work.
Open your plugins list today. If Avada Builder still shows 3.16.1 or older, the job isn’t finished – even if the theme looks up to date.