External risk intelligence

Avada Core Cross-Site Request Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-65471

This vulnerability affects a WordPress plugin (Avada Core). WordPress plugins are commonly deployed on internet-facing web servers and websites, making them reachable via the public internet as part of the standard web application environment.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a Cross-Site Request Forgery (CSRF) vulnerability found in Avada Core. This type of flaw allows attackers to trick users into performing unwanted actions on a web application they are authenticated to, potentially leading to unauthorized changes or data compromise. The primary concern is to confirm if this specific technology is in use and exposed.

Unauthenticated users can trigger unwanted actions.
Confirms use of Avada Core and its exposure.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by tricking a logged-in user into visiting a malicious link. This would allow the attacker to perform actions on behalf of the user without their knowledge, potentially leading to unauthorized changes or data compromise.

Requires no authentication to attempt.
Triggers through user interaction with a crafted link.
Risk of unauthorized actions and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated Cross-Site Request Forgery (CSRF) vulnerability could allow an attacker to trick a logged-in user into performing unintended actions on a vulnerable system when they interact with a malicious website. This could potentially impact the integrity and availability of the affected service when supported by the advisory.

User actions and data integrity.
Via a malicious link or website.
Unauthorized changes to system settings.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in Avada Core impacts applications using versions prior to 5.15.6. Security and infrastructure teams should prioritize identifying all instances of the affected plugin, confirming their exposure to external networks, and assessing business criticality to prioritize remediation efforts. Coordinating with vendor management may be necessary if the plugin is part of a third-party solution.

Platform and security teams should own the issue.
Verify external reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Avada Core and what is it used for?

Avada Core is a foundational plugin for the Avada website builder ecosystem on WordPress. It provides essential functional components and integrations that enable the theme to manage complex site layouts, custom post types, and advanced design elements. Users rely on this plugin to ensure the underlying architecture of their WordPress site remains operational and consistent with the theme's features.

How does the CSRF weakness in CVE-2026-65471 function?

CVE-2026-65471 is classified as CWE-352, or Cross-Site Request Forgery. This vulnerability happens when an application fails to verify that an incoming request was intentionally sent by the authorized user. Essentially, the software trusts requests originating from the user's browser, allowing an attacker to force that browser to perform unintended actions, such as changing account settings or triggering administrative functions, without the user's consent.

When is this CSRF flaw triggered?

This vulnerability is triggered when an authenticated user visits a malicious link or website while logged into their WordPress dashboard. The attack succeeds by leveraging the user's active session to submit requests to the site. Importantly, the bug is not triggered if the user is not actively logged in or if they are using a browser that does not allow third-party requests, as the attack requires the victim's existing credentials to succeed.

How do I know if I am at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because Avada Core is a WordPress plugin, it is typically deployed on web servers reachable via the public internet. If your site runs an affected version of this plugin and is accessible to the public, it is considered internet-facing. This exposure increases the likelihood that a malicious link could be presented to an administrator, making the application a viable target for this CSRF vulnerability.

What steps should I take if I run Avada Core?

First, verify your installed version of the Avada Core plugin to see if it is 5.15.6 or older. If you are using an affected version, the primary goal is to update the plugin to the latest secure release provided by the vendor. While planning your update, ensure you have a recent backup of your site and review your WordPress administrative activity to identify any suspicious changes that may have occurred.

References

patchstack.com/database/wordpress/plugin/fusion-core/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.