Avada Fusion Builder WordPress Plugin Authorization Bypass Vulnerability

The Avada (Fusion) Builder plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 7.16.1. The plugin fails to properly verify authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value via the notification email_message [field] placeholder andethe {action_hook,...} dynamic-data token.

The 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] that the public form-submit endpoint parses. This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content.

• A verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wp_scheduled_delete action.
• Other non-deny-listed hooks extend the impact to denial of service (e.g. wp_maybe_auto_update)and, where vulnerable third-party handlers are installed, further privileged writes.
• The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read result is delivered only to the site ownerand is not attacker-exfiltrable through the plugin's own email/response paths.
• Exploitation requires a published Avada formwith AJAX submissionand a notification whose email_message template includes an [all_fields] or explicit [field] placeholder -the default form configuration.