What is the CVSS score of CVE-2026-56008?

CVE-2026-56008 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fusion Builder are affected by CVE-2026-56008?

The Fusion Builder WordPress plugin, bundled with the widely deployed Avada theme, contains a privilege escalation vulnerability (CVE-2026-56008) that allows contributor-level users to gain full…

How to fix or mitigate CVE-2026-56008?

Within 24 hours: Audit all WordPress instances for Avada theme deployment and Fusion Builder version 3.15.4 or earlier; disable contributor accounts unless operationally required; implement IP allowlisting for administrative access. Within 7 days: Deploy WordPress role-capability hardening plugin to restrict contributor permissions; enable comprehensive audit logging for all user actions and privilege changes. Within 30 days: Subscribe to Patchstack advisories for patch availability; once released, test and deploy Fusion Builder patch immediately; conduct forensic audit of user accounts and site logs for unauthorized escalation or malicious activity.

Fusion Builder CVE-2026-56008

EUVD-2026-39685 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-26 audit@patchstack.com

GHSA-9q77-gqxj-q9gx

Privilege Escalation

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:38 vuln.today

DescriptionCVE.org

Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.

AnalysisAI

Privilege escalation in the Fusion Builder WordPress plugin (versions 3.15.4 and earlier) lets a low-privileged authenticated user, such as a Contributor, gain capabilities far beyond their role and effectively act as an administrator. The flaw was reported by Patchstack and carries a CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit all WordPress instances for Avada theme deployment and Fusion Builder version 3.15.4 or earlier; disable contributor accounts unless operationally required; implement IP allowlisting for administrative access. …

Threat intelligence, references, and detailed analysis are available after sign-in.