Unauthenticated content destruction via form-controlled action hooks

Authorization bypass in Avada Builder 7.16.1 and earlier allows remote attackers to delete trashed content via form submissions. Notification placeholders process attacker-controlled action_hook tokens, while is_content_request_supplied() checks args but ignores the formData parsed by the public endpoint. Exploitation requires a published AJAX form with an all_fields or explicit field notification placeholder, the default configuration; invoking wp_scheduled_delete permanently deletes trashed posts, pages, and comments.