CVE-2026-97670 - Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

CVE ID :CVE-2026-97670 Published : Oct. 10, 2026, 4:26 a.m. | 1 hour, 3 minutes ago Description :The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization...

#Sicherheitslücke

ARTICLEVIEW

CVE-2026-97670 - Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

VERWANDTEARTIKEL

CVE-2025-64393

CVE-2026-103889 - 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

CVE-2026-94589 - Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

CVE-2026-107645 - Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

CVE-2026-104732 - Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

CVE-2026-104797 - Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action