Wordfence published CVE-2026-97670 on October 10, 2026: an unauthenticated authorization bypass in Avada’s Fusion Builder affecting Avada through 7.16.1. By submitting a public form with a notification email, an anonymous visitor could trigger internal WordPress actions — with the verified outcome being the permanent, irreversible deletion of content sitting in the site’s trash. No login or user interaction is required, and the vulnerable form configuration is the default one. ThemeFusion shipped the fix in Avada 7.16.2 (September 30).
Avada remains one of the best-selling WordPress themes of all time, so this flaw’s reach is wide. Check your theme version today, update to 7.16.2 or later, and review your public forms and trash contents — once deleted content is gone, it can’t be recovered.
Not sure your site is patched? Our website care plans cover theme and plugin updates, security hardening, and regular backups, so one missed update never becomes a disaster. Learn more at https://qamardigitalventuresllc.com/
Source: Wordfence (October 2026), via BtCIRT.
