What is the CVSS score of CVE-2026-32452?

CVE-2026-32452 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fusion Builder are affected by CVE-2026-32452?

CVE-2026-32452 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-32452?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Fusion Builder CVE-2026-32452

EUVD-2026-12003 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Fusion Builder

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.15.0

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12003

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.

AnalysisAI

This vulnerability is a missing authorization flaw in ThemeFusion Fusion Builder that allows unauthenticated attackers to exploit incorrectly configured access controls to modify content or settings. The issue affects Fusion Builder versions prior to 3.15.0, and the network-accessible nature combined with no authentication requirement means any remote attacker can exploit it without special privileges. While the CVSS score of 5.3 indicates moderate severity with integrity impact but no confidentiality or availability loss, the lack of authentication requirement elevates real-world risk for WordPress sites using affected versions.

Technical ContextAI

Fusion Builder is a page builder plugin for WordPress developed by ThemeFusion that allows users to create custom website layouts and content. The vulnerability stems from CWE-862 (Missing Authorization), which occurs when the application fails to properly enforce access control checks before allowing sensitive operations. Specifically, certain administrative or modification functions within Fusion Builder lack proper capability checks, meaning the plugin does not verify that a user has the required permissions before executing actions that should be restricted. This is a common pattern in WordPress plugins where functions fail to call current_user_can() or similar authorization checks before processing user input, allowing unauthenticated or low-privilege users to perform actions reserved for administrators.

RemediationAI

Immediately upgrade Fusion Builder to version 3.15.0 or later, which includes the authorization checks to enforce proper access control. To update, navigate to the WordPress admin dashboard, go to Plugins > Installed Plugins, locate Fusion Builder, and click Update. Alternatively, download the latest version from the official WordPress plugin repository or ThemeFusion's website and upload it manually via SFTP or the WordPress plugin uploader. For sites unable to patch immediately, implement these interim mitigations: restrict access to the WordPress admin panel using IP whitelisting or a Web Application Firewall (WAF) rule set; disable the REST API if not required (via security plugins or wp-config.php configuration); monitor for unauthorized modifications to pages and posts using security auditing plugins; and consider temporarily disabling Fusion Builder if the site can function without it. Ensure all WordPress core files, themes, and other plugins are also up to date, as this reduces the overall attack surface.