Junglewise Threat Intelligence

CVE-2026-6279: ThemeFusion Avada Builder RCE via PHP Function Injection

CVE-2026-6279 · Severity: critical · CVSS 9.8 · Published 2026-05-21

Technologies: ThemeFusion Avada Builder. Vendors: ThemeFusion.

Executive brief

The Avada Builder plugin for WordPress, a popular tool for designing website layouts, contains a critical security flaw that allows unauthorized individuals to take full control of a website. By sending a specially crafted request, an attacker can execute their own code on the server without needing to log in. This could lead to the theft of sensitive customer data, complete website defacement, or the installation of malware.

Technical details

The Avada Builder (fusion-builder) plugin is vulnerable to Remote Code Execution (RCE) due to improper input validation in the Fusion_Builder_Conditional_Render_Helper::get_value() function. Specifically, the 'wp_conditional_tags' case processes attacker-controlled values from a base64-encoded JSON blob and passes them directly to the PHP call_user_func() function without an allowlist. While the targeted 'fusion_get_widget_markup' AJAX endpoint is protected by a nonce, this nonce is deterministically generated for unauthenticated users (ID 0) and leaked in the source code of pages using Post Cards or Table of Contents elements. An unauthenticated attacker can retrieve this nonce and send a crafted request to execute arbitrary PHP functions, leading to full system compromise. The issue is addressed in version 3.15.3 (via Avada 7.15.3).

Affected products

  • ThemeFusion Avada Builder (fusion-builder) up to and including 3.15.2

Timeline

  • 2026-05-12: patched: Avada version 7.15.3 released
  • 2026-05-21: disclosed: CVE-2026-6279 published

References

Related threats