SecurityOnlineDo Son
CVE-2026-8713 lets attackers delete files in Avada Builder plugin
Part of the CVE-2026-8713 story · since 19 Jun
- Fri 19 Jun, 08:51 UTC. SecurityOnline, first report. CVE-2026-8713 lets attackers delete files in Avada Builder plugin. This article, 1st of 1.
A critical vulnerability, CVE-2026-8713, has been detected in the Avada Builder plugin for WordPress, impacting around 1 million sites. This flaw allows unauthenticated attackers to delete any server file, including critical WordPress files, by exploiting improper file path validation in the plugin's maybe_delete_files function. The vulnerability is rated 9.1 on the CVSS scale. Administrators are advised to update Avada Builder to version 3.15.4 or later to mitigate the risk. The researcher who discovered the bug received a $3,600 bounty. Immediate action is essential as no confirmed mass exploitation has been reported yet.
How the story developed
1 article from 1 outlet since 19 Jun. Quiet since 19 Jun. This was the first report.
- Fri 19 Jun, 08:51 UTC. SecurityOnline, first report. CVE-2026-8713 lets attackers delete files in Avada Builder plugin. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Fri 19 JunDay 01
- CVE-2026-8713 lets attackers delete files in Avada Builder plugin08:51 · SecurityOnline · First report · This article, 1st of 1