The Avada (Fusion) Builder plugin for WordPress is affected by an insufficient file path validation in the maybe_delete_files function used when processing form entries. An unauthenticated attacker can submit a crafted path‑traversal payload through the wp_ajax_nopriv_fusion_form_submit_ajax handler and force the application to delete any file on the server. Because the plugin is typically installed on a WordPress site, deleting critical files such as wp-config.php can lead to full loss of control over the site, effectively enabling remote code execution or site takeover.

All WordPress installations using the Avada (Fusion) Builder plugin up to and including version 3.15.3 are vulnerable. Any site that has published a Fusion form configured to save entries to the database may be impacted, as the exploit relies on the form’s entry‑processing logic.

The vulnerability carries a CVSS score of 9.1, indicating high potential for damage. The EPSS score is 1%, suggesting a very low but nonzero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The exploit requires no authentication and only a crafted form submission, making it theoretically easy for attackers to trigger. If the attacker deletes critical configuration files, remote code execution becomes possible, giving full control over the affected server.