What is the CVSS score of CVE-2026-32451?

CVE-2026-32451 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fusion Builder are affected by CVE-2026-32451?

CVE-2026-32451 presents moderate security risk, a missing authorization vulnerability rated CVSS 6.3. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-32451?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Fusion Builder CVE-2026-32451

EUVD-2026-12001 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Fusion Builder

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 10:22 NVD

6.3 (MEDIUM) 6.5 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

3.15.0

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12001

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 6.3

DescriptionCVE.org

Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

AnalysisAI

Fusion Builder, a WordPress plugin by ThemeFusion, contains a missing authorization vulnerability (CWE-862) that allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions. Versions prior to 3.15.0 are affected, and attackers can exploit incorrectly configured access control to read, modify, or delete sensitive data. The CVSS 6.3 score reflects moderate severity with network accessibility and low attack complexity, though no public evidence of active KEV inclusion or widespread exploitation has been documented at this time.

Technical ContextAI

Fusion Builder is a drag-and-drop page builder plugin for WordPress that extends the Avada theme ecosystem. The vulnerability stems from CWE-862 (Missing Authorization), a class of defect where the application fails to properly enforce authorization checks on sensitive operations. This typically manifests in WordPress plugins when REST API endpoints, admin AJAX actions, or administrative functions lack proper capability checks (is_user_capable() or similar WordPress permission validation). The affected software operates within the WordPress plugin architecture (CPE: cpe:2.3:a:themefusion:fusion-builder), meaning the plugin runs with access to WordPress's database and file system. The root cause is likely insufficient validation of user roles and capabilities before allowing modifications to builder content, settings, or configurations that should be restricted to administrators or specific user roles.

RemediationAI

Immediately upgrade Fusion Builder to version 3.15.0 or later, which patches the authorization vulnerability. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, and click Update for Fusion Builder. If immediate patching is not possible, implement compensating controls: restrict Fusion Builder editing capabilities to trusted administrator-level accounts only via WordPress user role management, disable REST API endpoints for untrusted user roles using plugins like Disable REST API or custom code, audit and remove unnecessary user accounts with edit_posts or higher capabilities, and monitor for suspicious builder activity via security plugins such as Wordfence or Sucuri. For additional guidance, consult the official ThemeFusion security advisory.