What is the CVSS score of CVE-2026-6279?

CVE-2026-6279 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Avada Builder are affected by CVE-2026-6279?

Any WordPress site using Avada Builder plugin (versions ≤3.15.2) faces immediate risk of complete server compromise through unauthenticated remote code execution.

How to fix or mitigate CVE-2026-6279?

Within 24 hours: Inventory all WordPress installations; identify those running Avada Builder ≤3.15.2 and confirm presence of Post Cards or Table of Contents elements. Within 7 days: Disable or deactivate the fusion-builder plugin on all affected sites, or deploy WAF rules blocking requests to /wp-admin/admin-ajax.php with fusion-builder action parameters. Within 30 days: Monitor Avada/Webaxy vendor advisory channels for patched version release (expected 3.15.3 or later); prepare deployment automation to patch all sites immediately upon availability.

Avada Builder CVE-2026-6279

EUVD-2026-31209 CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-21 Wordfence

GHSA-f53p-382v-8pj7

WordPress PHP RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 05:13 vuln.today

DescriptionCVE.org

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the wp_conditional_tags case in Fusion_Builder_Conditional_Render_Helper::get_value() passing attacker-controlled values from a base64-decoded JSON blob directly to call_user_func() without any allowlist validation. This is exploitable by unauthenticated attackers through the fusion_get_widget_markup AJAX endpoint, which is registered for non-privileged (unauthenticated) users via wp_ajax_nopriv_fusion_get_widget_markup. The endpoint is protected only by a nonce (fusion_load_nonce), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards ([fusion_post_cards]) or Table of Contents ([fusion_table_of_contents]) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.

AnalysisAI

Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and including 3.15.2 allows attackers to execute arbitrary PHP on affected sites by abusing an unsanitized call_user_func() invocation reachable through a public AJAX endpoint. Wordfence-reported issue affects any WordPress site running the Avada theme stack that exposes a Post Cards or Table of Contents element on a public page, since the protecting nonce is deterministically leaked in the page's JavaScript. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial precondition (visiting one page that emits the nonce) make this high-priority.

Technical ContextAI

The vulnerability is a CWE-74 injection flaw in the PHP code path Fusion_Builder_Conditional_Render_Helper::get_value(), specifically the wp_conditional_tags branch, which decodes a base64 JSON blob from request input and passes attacker-controlled values directly to PHP's call_user_func() without any allowlist or callable validation. Exposure occurs through the AJAX action fusion_get_widget_markup, registered via wp_ajax_nopriv_fusion_get_widget_markup, which makes the handler reachable by unauthenticated visitors. The only protection is a WordPress nonce (fusion_load_nonce) generated for user ID 0 (anonymous); because that nonce is identical for all unauthenticated visitors and is rendered into the JavaScript of any public page that contains a [fusion_post_cards] or [fusion_table_of_contents] shortcode, it provides no real authorization barrier. CPE cpe:2.3:a:themefusion:avada_(fusion)_builder identifies the affected component as ThemeFusion's commercial Avada Builder plugin distributed with the Avada theme.

RemediationAI

Upgrade Avada Builder to a version newer than 3.15.2 as soon as the vendor publishes a fixed release; the input data does not include an exact fix version, so released patched version not independently confirmed and administrators should consult the Avada changelog at https://avada.com/documentation/avada-changelog/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc72d78-d47c-4b36-8d69-8672e15ddf8c?source=cve to identify the patched build. Until a patched version is installed, remove the [fusion_post_cards] and [fusion_table_of_contents] shortcodes from all public pages so the fusion_load_nonce stops being leaked (this breaks those page elements but eliminates the reachable preauth nonce), and/or block the admin-ajax.php action=fusion_get_widget_markup request at the WAF or web server level (this disables legitimate widget-markup rendering for that action). As a defense-in-depth measure, restrict access to wp-admin/admin-ajax.php for anonymous users where business logic permits, accepting that this can break other plugins that rely on nopriv AJAX endpoints.