CVE-2026-6279
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2.
Published May 21, 2026 · updated Jul 23, 2026
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the case in passing attacker-controlled values from a base64-decoded JSON blob directly to without any allowlist validation. This is exploitable by unauthenticated attackers through the AJAX endpoint, which is registered for non-privileged (unauthenticated) users via . The endpoint is protected only by a nonce ( ), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards ( ) or Table of Contents ( ) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 21, 2026 · NIST NVD
Detected
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the case in passing attacker-controlled values from a base64-decoded JSON blob directly to without any allowlist validation. This is exploitable by unauthenticated attackers through the AJAX endpoint, which
Jul 23, 2026 · NIST NVD
Updated
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the case in passing attacker-controlled values from a base64-decoded JSON blob directly to without any allowlist validation. This is exploitable by unauthenticated attackers through the AJAX endpoint, which
Sources
- CVE.orgVulnerability recordCVE-2026-6279
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-6279
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the case in `Fusion_Builder_Conditional_Render_Helper::get_value(
nvd.nist.gov