CVE-2026-97471

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.

• CWE-200

• https://avada.com/blog/version-7-16-2-security-update/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbd41a8-b9ff-4afe-bcfd-1df52d8d3b5f?source=cve

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97456In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9746When using $changestreams and $_requestReshardingResumeToken…7.1
• CVE-2026-97468Apache CXF's STSTokenValidator and Security Token Service (S…9.1
• CVE-2026-97469PostgreSQL Anonymizer contains a vulnerability that allows u…4.3
• CVE-2026-9747Adding fromRouter:true and runtimeConstants.userRoles could …7.1
• CVE-2026-97470The Tourfic – AI Powered Travel Booking, Hotel Booking & Car…6.4
• CVE-2026-97472In the Linux kernel, the following vulnerability has been re…
• CVE-2026-97473In the Linux kernel, the following vulnerability has been re…
• CVE-2026-97474In the Linux kernel, the following vulnerability has been re…7.4
• CVE-2026-97475In the Linux kernel, the following vulnerability has been re…
• CVE-2026-97476In the Linux kernel, the following vulnerability has been re…
• CVE-2026-97477In the Linux kernel, the following vulnerability has been re…