Is CVE-2026-6279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6279 being exploited in the wild.

How severe is CVE-2026-6279?

Critical severity, with a CVSS score of 9.8, published 21 May 2026.

Which products and versions are affected?

ThemeFusion Avada Builder up to and including 3.15.2.

Is there a fix for CVE-2026-6279?

A patch was published on 2026-05-12: Avada version 7.15.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6279 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6279?

Check whether you run ThemeFusion Avada Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6279: ThemeFusion Avada Builder RCE via PHP Function Injection

CVE-2026-6279 · Severity: critical · CVSS 9.8 · Published 2026-05-21

The Avada Builder plugin for WordPress, a popular tool for designing website layouts, contains a critical security flaw that allows unauthorized individuals to take full control of a website. By sending a specially crafted request, an attacker can execute their own code on the server without needing to log in. This could lead to the theft of sensitive customer data, complete website defacement, or the installation of malware.

Technologies: ThemeFusion Avada Builder. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-6279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6279 being exploited in the wild.
How severe is CVE-2026-6279?: Critical severity, with a CVSS score of 9.8, published 21 May 2026.
Which products and versions are affected?: ThemeFusion Avada Builder up to and including 3.15.2.
Is there a fix for CVE-2026-6279?: A patch was published on 2026-05-12: Avada version 7.15.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6279 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6279?: Check whether you run ThemeFusion Avada Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Avada Builder (fusion-builder) plugin is vulnerable to Remote Code Execution (RCE) due to improper input validation in the Fusion_Builder_Conditional_Render_Helper::get_value() function. Specifically, the 'wp_conditional_tags' case processes attacker-controlled values from a base64-encoded JSON blob and passes them directly to the PHP call_user_func() function without an allowlist. While the targeted 'fusion_get_widget_markup' AJAX endpoint is protected by a nonce, this nonce is deterministically generated for unauthenticated users (ID 0) and leaked in the source code of pages using Post Cards or Table of Contents elements. An unauthenticated attacker can retrieve this nonce and send a crafted request to execute arbitrary PHP functions, leading to full system compromise. The issue is addressed in version 3.15.3 (via Avada 7.15.3).

Affected products

ThemeFusion Avada Builder (fusion-builder) up to and including 3.15.2

Timeline

2026-05-12: patched: Avada version 7.15.3 released
2026-05-21: disclosed: CVE-2026-6279 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.