What is the CVSS score of CVE-2026-54193?

CVE-2026-54193 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fusion Builder are affected by CVE-2026-54193?

Fusion Builder WordPress plugin (versions ≤3.15.4) enables authenticated Contributor-level users to delete arbitrary files on the web server, including critical system files such as wp-config.php…

How to fix or mitigate CVE-2026-54193?

Within 24 hours: Audit all Contributor-level and higher user accounts in affected WordPress installations; remove or downgrade any unnecessary Contributor accounts; implement file integrity monitoring on wp-config.php and wp-settings.php. Within 7 days: Restrict Contributor role permissions to only essential users; disable Fusion Builder if not operationally critical; enable WordPress security logging for file operations. Within 30 days: Monitor Fusion Builder vendor advisories for security patch release to version 3.15.5+; apply patches immediately upon availability; if no patch timeline is announced within 30 days, migrate to alternative page builder plugins and deactivate Fusion Builder.

Fusion Builder CVE-2026-54193

HIGH

Path Traversal (CWE-22)

2026-06-17 Patchstack

Path Traversal Fusion Builder

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Remote contributor-authenticated request (AV:N, AC:L, PR:L, UI:N) deletes files outside the plugin (S:C); only availability is directly impacted (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:27 vuln.today

DescriptionCVE.org

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

AnalysisAI

Arbitrary file deletion in the Fusion Builder WordPress plugin (versions <= 3.15.4) allows authenticated users with Contributor-level privileges to delete arbitrary files on the underlying server via a path traversal flaw. Deletion of critical files such as wp-config.php can force WordPress into setup mode, enabling site takeover; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Fusion Builder is a commercial WordPress page-builder plugin developed by ThemeFusion (cpe:2.3:a:themefusion:fusion_builder), commonly bundled with the Avada theme and present on a very large number of WordPress installations. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal): a plugin handler that accepts a file path or filename from a contributor-level user fails to canonicalize and constrain the path within the plugin's intended directory, allowing '../' sequences (or absolute paths) to reach files outside the plugin scope. Because WordPress runs the web server process with read/write access to its own document root and wp-content, an unconstrained unlink()-style operation translates directly into deletion of arbitrary files owned by the web user.

RemediationAI

Upgrade the Fusion Builder plugin to a version newer than 3.15.4 once ThemeFusion publishes a fixed release; refer to the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fusion-builder/vulnerability/wordpress-fusion-builder-plugin-3-15-4-arbitrary-file-deletion-vulnerability for the patched version and vendor changelog. Patch status per available data: no vendor-released patch version is confirmed in the input at time of analysis. As compensating controls until a patched build is deployed, temporarily disable open user registration or restrict the Contributor role from creating posts that invoke Fusion Builder editing endpoints, place a WAF rule blocking path-traversal sequences (../ , %2e%2e%2f, absolute paths) on the plugin's AJAX/admin-ajax endpoints, and enforce least-privilege filesystem permissions so the web user cannot delete wp-config.php or files outside wp-content/uploads (trade-off: some plugins may break if write access is overly restricted). Maintain off-host backups of wp-config.php and core files so that a successful deletion does not enable the wp-config rewrite takeover.