The Avada (Fusion) Builder plugin for WordPress allows unauthenticated attackers to read sensitive user information by supplying arbitrary values to the 'args[link_target]' parameter. By leveraging the {user_meta} dynamic data token, an attacker can obtain any user meta field, including administrator emails, login names, wp_user_level, and customer PII. This constitutes a sensitive information exposure that can compromise privacy and facilitate further attacks.

Any WordPress site running Avada (Fusion) Builder version 3.16.1 or earlier is affected. The vulnerability applies to all builds up to and including 3.16.1 across all supported operating systems, where the plugin is activated and the /wp-json/fusion/v1/... endpoint is reachable. WordPress users who have installed the plugin without updating are at risk.

The CVSS score is 5.3, indicating moderate severity. EPSS is less than 1%, suggesting low exploitation probability at present. The vulnerability is not listed in CISA KEV. Attackers need only to visit a public page containing the [fusion_instagram] shortcode so that the autocomplete nonce is exposed in plaintext, then craft a request to the endpoint with args[link_target] set to a {user_meta} token for any desired field. No authentication is required, so the attack is trivial once the nonce is discovered. Because the attack does not depend on privileged access or other preconditions, the potential impact can be far-reaching for entire user bases of affected sites.