CVE-2026-1509

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.

• CWE-94

• https://avada.com/documentation/avada-changelog/
• https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=cve

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15083Improperly Controlled Modification of Dynamically-Determined…4.2
• CVE-2026-15084Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-15085Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-15086vulnerability in Drupal Raw Formatter [Meta Tag Formatter] a…5.9
• CVE-2026-15087vulnerability in Drupal Clean RESTful allows . This issue af…5.9
• CVE-2026-15089vulnerability in Drupal Commerce guest registration allows .…9.1
• CVE-2026-15091IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…9.3
• CVE-2026-15093IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…4.3
• CVE-2026-15094The WP Hotel Booking plugin for WordPress is vulnerable to R…6.1
• CVE-2026-15096The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15097The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15099The Delicious Recipes plugin for WordPress is vulnerable to …6.4