The Avada (Fusion) Builder plugin for WordPress has a flaw where the function fusion_get_post_custom_field() does not verify whether metadata keys are protected by an underscore prefix before returning their values. This insecure direct object reference (CWE‑639) allows an authenticated user with Subscriber role or higher to retrieve protected post metadata through the Dynamic Data feature’s post_custom_field parameter. The outcome is the loss of confidentiality for data that should remain private, such as internal notes, API keys, or other sensitive configuration values.

WordPress sites that have installed the Avada (Fusion) Builder plugin from ThemeFusion and are running any version up to and including 3.15.1. Systems using newer versions are not affected. The vulnerability can only be exploited when the Dynamic Data feature is enabled and the user supplies the post_custom_field parameter.

The CVSS score of 4.3 indicates a low severity rating. No EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker requires valid credentials with at least Subscriber access, so the threat is limited to authenticated users. Nonetheless, because the exposed data is confidential, the risk remains non‑zero for sites that store sensitive information in post metadata and enforce strict confidentiality controls.