Is CVE-2026-54193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54193 being exploited in the wild.

How severe is CVE-2026-54193?

High severity, with a CVSS score of 7.7, published 17 June 2026.

Which products and versions are affected?

ThemeFusion Fusion Builder <= 3.15.4.

Is there a fix for CVE-2026-54193?

A patch was published on 2026-06-17: Version 3.15.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54193 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54193?

Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54193: ThemeFusion Fusion Builder arbitrary file deletion via path traversal

Q: Is there a fix for CVE-2026-54193?

A patch was published on 2026-06-17: Version 3.15.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54193 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54193?

Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54193 · Severity: high · CVSS 7.7 · Published 2026-06-17

Fusion Builder, a popular page-building tool for WordPress websites, contains a security flaw that allows users with 'Contributor' level access to delete arbitrary files on the server. This could lead to a complete website outage if critical system files are removed, or it could be used to bypass security controls by deleting configuration files. The vulnerability is particularly concerning for sites that allow multiple users to contribute content.

Technologies: ThemeFusion Fusion Builder. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-54193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54193 being exploited in the wild.
How severe is CVE-2026-54193?: High severity, with a CVSS score of 7.7, published 17 June 2026.
Which products and versions are affected?: ThemeFusion Fusion Builder <= 3.15.4.
Is there a fix for CVE-2026-54193?: A patch was published on 2026-06-17: Version 3.15.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54193 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54193?: Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Fusion Builder plugin for WordPress up to version 3.15.4. The flaw allows authenticated attackers with Contributor-level roles to delete arbitrary files on the server by manipulating file paths. This is achieved through insufficient validation of user-supplied input in file-handling components. Successful exploitation can lead to a denial-of-service (DoS) condition by deleting core WordPress or plugin files. The issue is resolved in version 3.15.5.

Affected products

ThemeFusion Fusion Builder <= 3.15.4

Timeline

2026-06-10: other: Reported by researcher daroo
2026-06-16: advisory: Patchstack advisory published
2026-06-17: disclosed: NVD publication date
2026-06-17: patched: Version 3.15.5 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.