CVE-2026-97471 ThemeFusion CVE debrief

Who should care

Defenders responsible for WordPress installations with the Avada (Fusion) Builder plugin should assess exposure and prioritize updates to version 3.16.2 or later. This includes reviewing user meta data for potential exposure, verifying and updating the plugin, and monitoring for suspicious activity related to the 'args[link_target]' parameter. Additionally, defenders should consider implementing compensating controls for exposed systems and tracking remedi

Why it matters

The Avada (Fusion) Builder plugin vulnerability allows unauthenticated attackers to extract sensitive user information, posing a risk to WordPress installations. Defenders should prioritize updates and review user meta data.

• Unauthenticated attackers can extract arbitrary user meta values for any user ID
• Exposure of administrator email addresses, login names, and wp_user_level
• Exposure of WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1
• Verification of user meta data for potential exposure is required

Technical summary

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The vulnerability can be triggered by harvesting the awb-instagram-nonce required to trigger this endpoint, which is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode.

Defensive priority

Defenders should prioritize verifying and updating Avada (Fusion) Builder versions to 3.16.2 or later, and review user meta data for potential exposure.

Recommended defensive actions

• Verify and update Avada (Fusion) Builder to version 3.16.2 or later
• Review user meta data for potential exposure
• Monitor for suspicious activity related to the 'args[link_target]' parameter
• Perform a thorough review of user meta data to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and parameters. However, the corpus does not establish versions beyond 3.16.1 or provide specific examples of exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.