# CVE-2026-12256: ThemeFusion Avada PHP Object Injection

Source: https://junglewise.ai/threats/cve-2026-12256-themefusion-avada-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-12256 · Severity: high · CVSS 8.8 · Published 2026-06-17

Avada is a popular website-building theme for WordPress. A security flaw has been identified that allows users with 'Contributor' level access to execute unauthorized commands on the server. This could lead to a total takeover of the website, theft of sensitive data, or a complete service outage.

Technologies: [ThemeFusion Avada](https://junglewise.ai/threats/technologies/avada). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-12256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12256 being exploited in the wild.

**How severe is CVE-2026-12256?** High severity, with a CVSS score of 8.8, published 17 June 2026.

**Which products and versions are affected?** ThemeFusion Avada <= 3.15.3.

**Is there a fix for CVE-2026-12256?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12256 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-12256?** Check whether you run ThemeFusion Avada at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP Object Injection vulnerability exists in the ThemeFusion Avada theme for WordPress (versions 3.15.3 and below) due to improper deserialization of user-supplied data (CWE-502). An attacker with Contributor-level privileges can exploit this flaw by submitting malicious input that, when processed by the server, allows for the execution of a POP (Property-Oriented Programming) chain. Successful exploitation can lead to remote code execution (RCE), SQL injection, or path traversal, depending on the available classes in the environment. The issue is resolved in version 3.15.4.

## Affected products

- ThemeFusion Avada <= 3.15.3

## Timeline

- 2026-05-13: other: Reported by researcher daroo
- 2026-06-15: advisory: Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD

## References

- [https://wordpress.org/themes](https://wordpress.org/themes)
- [https://patchstack.com/database/wordpress/theme/avada/vulnerability/wordpress-avada-theme-3-15-3-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/avada/vulnerability/wordpress-avada-theme-3-15-3-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [Avada theme arbitrary file upload via Avada Forms](https://junglewise.ai/threats/cve-2026-115346-the-avada-website-builder-for-wordpress-woocommerce-theme-for)
- [Avada theme stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-97340-the-avada-website-builder-for-wordpress-woocommerce-theme-for)
- [Avada theme reflected cross-site scripting in lang parameter](https://junglewise.ai/threats/cve-2026-84925-the-avada-website-builder-for-wordpress-woocommerce-theme-for)