CVE-2026-8713

The Avada Builder plugin for WordPress has a vulnerability that allows an attacker to delete any file on the server without needing authentication. This is due to a flaw in how the plugin checks file paths, which can be exploited by submitting a specially crafted form entry. The attacker can then use the plugin's own features to force the deletion of the malicious file, potentially leading to remote code execution if the wrong file is deleted.

Based on public CVE data (MITRE/NVD).