CVE-2026-65471
Avada Core versions 5.15.6 and earlier are vulnerable to an unauthenticated Cross‑Site Request Forgery (CSRF) attack. An attacker can trick a logged‑in user into performing actions that compromise the site’s confidentiality, integrity, and availability. The flaw is critical because it requires no privileges and can be triggered from any network location.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Avada Core plugin for WordPress, versions 5.15.6 and earlier.
Real-world impact
An attacker could cause a logged‑in user to unknowingly execute actions that change site settings, delete content, or otherwise disrupt the site, potentially leading to data loss or downtime.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be exploited over the network with no authentication, requires only a user interaction (e.g., clicking a link), and can alter all aspects of the system—confidentiality, integrity, and availability—making it a critical risk.
What to do about it
- ›Upgrade Avada Core to a version newer than 5.15.6 if available.
- ›Implement CSRF protection such as requiring a valid CSRF token for state‑changing requests.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.