What is the CVSS score of CVE-2026-54194?

CVE-2026-54194 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Fusion Builder are affected by CVE-2026-54194?

ThemeFusion Fusion Builder plugin (versions ≤3.15.4) contains a critical remote code execution vulnerability in its object deserialization routine, exploitable by authenticated users with…

How to fix or mitigate CVE-2026-54194?

Within 24 hours: Identify all WordPress installations running Fusion Builder ≤3.15.4 and audit current Contributor-level account assignments. Within 7 days: Either disable and uninstall the plugin entirely, or revoke Contributor-level access from untrusted user accounts. Within 30 days: Establish monitoring of ThemeFusion security advisories for a patched version; evaluate plugin replacement options if no patch timeline is announced.

Fusion Builder CVE-2026-54194

EUVD-2026-37509 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Fusion Builder

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint with low attack complexity, but description requires Contributor authentication so PR:L (not PR:N); successful POP chain typically yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:24 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

AnalysisAI

PHP Object Injection in the ThemeFusion Fusion Builder WordPress plugin (versions ≤ 3.15.4) allows authenticated users with Contributor-level access to inject crafted serialized PHP objects that are deserialized by the plugin. Successful exploitation can lead to property-oriented programming (POP) chain execution depending on classes loaded in the WordPress runtime, with potential outcomes ranging from arbitrary file operations to remote code execution. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the Contributor prerequisite is low in many multi-author WordPress deployments.

Technical ContextAI

Fusion Builder is a commercial WordPress page builder plugin developed by ThemeFusion (CPE cpe:2.3:a:themefusion:fusion_builder), widely bundled with the popular Avada theme. The flaw is a CWE-502 (Deserialization of Untrusted Data) issue: user-controllable input reaches a PHP unserialize() call (or equivalent), so an attacker who can supply a serialized payload can instantiate arbitrary PHP classes available in the WordPress process. Exploitation of such bugs typically relies on a POP gadget chain - either inside WordPress core, Fusion Builder/Avada itself, or a co-installed plugin - to convert object instantiation into file writes, SQL execution, or command execution.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fusion-builder/vulnerability/wordpress-fusion-builder-plugin-3-15-4-php-object-injection-vulnerability) and the ThemeFusion changelog for a version newer than 3.15.4 and upgrade as soon as one is published. Until a fixed release is installed, restrict Contributor (and higher untrusted) account creation by disabling open user registration in WordPress (Settings → General → 'Anyone can register' off) and audit existing Contributor accounts, accepting the trade-off of blocking legitimate guest authors. As a virtual-patching control, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks serialized PHP payloads (parameters beginning with O:, a:, or s: followed by length markers) to Fusion Builder AJAX/REST endpoints; this can produce false positives on legitimate builder traffic, so monitor before enforcement.