CVE-2026-1541 PUBLISHED

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

Assigner: Wordfence
Reserved: 28.01.2026 Published: 15.04.2026 Updated: 15.04.2026

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusion_get_post_custom_field() function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature's post_custom_field parameter.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor themefusion
Product Avada (Fusion) Builder
Versions Default: unaffected
  • affected from 0 to 3.15.1 (incl.)

Credits

  • Craig Smith finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE