Is CVE-2026-56008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56008 being exploited in the wild.

How severe is CVE-2026-56008?

High severity, with a CVSS score of 8.8, published 26 June 2026.

Which products and versions are affected?

ThemeFusion Fusion Builder <= 3.15.4.

Is there a fix for CVE-2026-56008?

A patch was published on 2026-06-26: NVD published date; fix available in version 3.15.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56008 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56008?

Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56008: ThemeFusion Fusion Builder privilege escalation in WordPress plugin

Q: Is there a fix for CVE-2026-56008?

A patch was published on 2026-06-26: NVD published date; fix available in version 3.15.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56008 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56008?

Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56008 · Severity: high · CVSS 8.8 · Published 2026-06-26

Fusion Builder, a popular page-building tool for WordPress websites, contains a security flaw that allows users with low-level 'Contributor' accounts to gain unauthorized administrative privileges. If exploited, an attacker could take full control of the website, potentially leading to data theft, site defacement, or the installation of malicious software. This vulnerability is considered high risk because it can be used to compromise a site's entire operations starting from a standard user account.

Technologies: ThemeFusion Fusion Builder. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-56008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56008 being exploited in the wild.
How severe is CVE-2026-56008?: High severity, with a CVSS score of 8.8, published 26 June 2026.
Which products and versions are affected?: ThemeFusion Fusion Builder <= 3.15.4.
Is there a fix for CVE-2026-56008?: A patch was published on 2026-06-26: NVD published date; fix available in version 3.15.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56008 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56008?: Check whether you run ThemeFusion Fusion Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the ThemeFusion Fusion Builder plugin for WordPress (versions 3.15.4 and earlier) due to incorrect privilege assignment (CWE-266). An authenticated attacker with 'Contributor' level permissions can exploit this flaw over the network without user interaction to escalate their privileges, potentially gaining full administrative control over the WordPress instance. The vulnerability has been addressed in version 3.15.5. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Affected products

ThemeFusion Fusion Builder <= 3.15.4

Timeline

2026-05-13: disclosed: Reported by researcher daroo
2026-06-18: advisory: Patchstack published advisory
2026-06-26: patched: NVD published date; fix available in version 3.15.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.