Wordfence Says Avada Builder Flaw Could Delete WordPress Files

Wordfence says Avada Builder patched a critical unauthenticated arbitrary file deletion vulnerability that could let attackers delete server files on vulnerable WordPress sites using saved Avada forms.

The Wordfence Threat Intelligence Team reported the issue on June 18, 2026 and identifies it as CVE-2026-8713. Wordfence rates the vulnerability 9.1 critical and says it affects Avada (Fusion) Builder versions up to and including 3.15.3, with 3.15.4 listed as the patched version.

Avada is not a small plugin target. Wordfence describes Avada Builder as a premium WordPress plugin with an estimated 1,000,000 active installations, and Avada’s own site describes the product as a WordPress and WooCommerce website builder trusted by more than one million website owners. That reach makes the operational lesson bigger than one bug: form builders, privacy cleanup jobs, and file upload workflows need the same threat modeling as authentication and payment features.

What Wordfence says happened

According to Wordfence, the vulnerability was reported through its bug bounty program on May 13, 2026. Wordfence says it sent full disclosure details to the Avada team on May 15, the developer acknowledged the report, and a patch was submitted on May 19. The researcher credited by Wordfence is daroo, with a listed bounty of $3,600.

The public advisory says exploitation requires a published Avada form configured to save entries to the database. That condition matters: this is not described as a universal exploit path for every Avada installation, but it is dangerous for sites that expose a vulnerable saved-form configuration to unauthenticated visitors.

Why file deletion can become site compromise

The affected path is a form-entry cleanup workflow

Wordfence says the vulnerable code path is the maybe_delete_files() function in the Fusion_Form_DB_Entries class. In Wordfence’s analysis, insufficient file path validation can let an attacker submit a path traversal payload through the unauthenticated wp_ajax_nopriv_fusion_form_submit_ajax handler and influence privacy cleanup fields so the entry is immediately processed for deletion.

The headline risk is not merely losing an uploaded file. Wordfence says arbitrary file deletion can lead to remote code execution when a sensitive file such as wp-config.php is deleted. That is why a file deletion flaw in a WordPress builder can escalate into a full site recovery problem, especially when backups, web server permissions, and incident response procedures are weak.

The vendor changelog confirms related hardening

Avada’s public changelog lists version 7.15.4 on June 2, 2026 with security hardening that includes “fixed possible arbitrary file deletion via form entry value in Avada Forms.” The version numbering differs from the Avada Builder plugin version named in Wordfence’s vulnerability summary, but the changelog independently supports the same class of Avada Forms security fix.

What WordPress operators should do now

Update Avada and Avada Builder immediately

Administrators should update Avada and Avada Builder to the latest available versions for their license and verify that Avada Builder is no longer on a version up to and including 3.15.3. For managed fleets, that check should include production, staging, archived campaign sites, and abandoned client sites that still receive traffic.

Find exposed saved forms

The vulnerable scenario described by Wordfence depends on published Avada forms that save entries to the database. Site owners should inventory those forms, confirm whether public visitors could submit to them before patching, and prioritize higher-risk forms that accept file-related values or feed sensitive workflows.

Review logs for exploitation signals

Security teams should review web server, WAF, CDN, and WordPress security logs for requests to wp-admin/admin-ajax.php involving the fusion_form_submit_ajax action, path traversal strings, or suspicious use of the fusion_privacy_expiration_interval and privacy_expiration_action fields. A log hit is not proof that a key file was deleted, but it is enough to justify deeper review of file integrity, backups, and recent configuration changes.

Firewall coverage is not a substitute for patching

Wordfence says all Wordfence users, including free users, are protected against exploits targeting the vulnerability by built-in path traversal protection in the Wordfence firewall. That is useful defense in depth, but it should not become a reason to delay the update. A WAF rule may reduce one exploit path while the vulnerable code remains installed, and not every site in a hosting fleet necessarily has the same firewall coverage or configuration.

The safer operating model is straightforward: patch the builder, verify exposed forms, review logs, and confirm that backups can restore a site if important files were removed. For agencies and hosts, this incident is also a reminder to track premium plugin versions as carefully as WordPress.org plugins. Premium components often sit outside normal public repository workflows, but they can still carry internet-scale risk when bundled into widely deployed site templates.

Sources

• Wordfence: Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin
• Avada public changelog
• Avada product site
• Featured image source: Tacet Venari cyber defense exercise on Wikimedia Commons

Featured image: A computer monitor during the U.S. Air Force Tacet Venari cyber defense exercise by Staff Sgt. Devin Boyer / U.S. Air Force, public domain as a U.S. Air Force work; cropped and converted to WebP for sxz.io.