1M WordPress Sites at Risk: Critical Unauthenticated Arbitrary File Deletion in Avada Builder (CVSS 9.1)

A critical unauthenticated arbitrary file deletion vulnerability (CVE-2026-8713, CVSS 9.1) in Avada (Fusion) Builder <= 3.15.3 allows attackers to perform path-traversal deletions (including wp-config.php) via form entry cleanup, potentially enabling full site takeover; Avada Builder 3.15.4 contains the fix and administrators should update immediately (approximately 1,000,000 sites may be affected; no confirmed mass exploitation reported).