CVE-2026-8713 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-8713 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-8713 is an arbitrary file deletion vulnerability in the Avada (Fusion) Builder plugin for WordPress, affecting all versions up to and including the latest patched release, caused by insufficient file path validation in the plugin's maybe_delete_files function.

Technical Detail

The flaw exists in the maybe_delete_files function, which fails to properly validate or sanitize user-supplied file paths before passing them to a file deletion operation. An attacker with sufficient access to trigger this function can supply a crafted path to delete arbitrary files on the underlying server filesystem, including critical WordPress configuration files such as wp-config.php. Deletion of core configuration files can render the site inoperable, expose database credentials during recovery attempts, or enable a full site takeover by forcing a WordPress reinstallation.

Exploitation Status

No known exploit code has been identified at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no public proof-of-concept or active exploitation has been confirmed as of June 26, 2026. This status should be monitored closely given the critical CVSS score of 9.1 and the broad install base of the Avada Builder plugin.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Given the widespread deployment of the Avada Builder plugin across WordPress installations, opportunistic actors targeting WordPress ecosystems broadly should be considered a plausible threat class, but no specific group has been linked to this CVE.

What To Do

Update the Avada (Fusion) Builder plugin to the latest available patched version immediately, prioritizing any internet-facing WordPress installations running the affected plugin. Administrators should verify the installed version through the WordPress dashboard and apply the update without delay given the critical severity rating. As an interim measure, restrict access to the WordPress admin panel via IP allowlisting or web application firewall rules to reduce the attack surface. Monitor server logs for anomalous file access or deletion events, particularly targeting wp-config.php or core WordPress directories. Confirm file integrity using a WordPress security scanner or file integrity monitoring tool following any suspicious activity.