CVE-2026-6279: Avada Fusion Builder up to 3.15.2 - Unauthenticated RCE via PHP Function Injection

Overview

The Avada Fusion Builder plugin for WordPress, in versions up to and including 3.15.2, contains an injection flaw that can allow unauthenticated attackers to run arbitrary PHP code. According to the Wordfence advisory, attacker-controlled values reach a dynamic function call without allowlist validation. The issue is classified as CWE-74 and was published on 2026-05-21.

Impact

• The CVSS 3.1 vector rates confidentiality, integrity and availability as High (C:H/I:H/A:H), with a base score of 9.8 reported by Wordfence.
• Successful exploitation would allow code to run in the context of the web server, which may lead to full site compromise. This is an inference from the rating and the description.
• SSVC data in the record marks technical impact as total and automatable as yes.

Affected products and versions

• Product: Themefusion Avada (Fusion) Builder, WordPress plugin fusion-builder.
• Versions: up to and including 3.15.2.
• The record contains no fixed version and no list of patched releases. Treat all versions up to and including 3.15.2 as affected until the vendor confirms a corrected release.

Exploitation status

The CISA KEV catalog does not list this CVE, so active exploitation is not confirmed by that source. The EPSS probability recorded is 0.02387 (percentile 0.8351), and the SSVC exploitation field is set to none. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

• Inventory all sites running the Avada Fusion Builder plugin and record their installed versions.
• Update to a release newer than 3.15.2 once the vendor publishes one; the available data does not name a fixed version.
• Until a corrected version is verified, consider temporarily disabling the plugin on internet-facing sites where its features are not essential, and limit exposure of AJAX functionality where practical.
• If there are signs of compromise, rotate credentials and review site integrity before returning the site to service.

Detection guidance

• Review web server and WordPress logs for unusual requests to AJAX endpoints, especially requests with unexpected parameters or unusually large encoded values.
• Look for unexpected PHP files, modified plugin files, new administrative users or unfamiliar scheduled tasks.
• Monitor for outbound connections from the web server that are not normal for the site.

Limitations of the available information

The record provides no fixed version, no vendor patch details and no exploitation telemetry beyond the KEV and SSVC fields. The CVSS data is attributed to Wordfence. The EPSS entry is dated 2026-10-13 in the record and should be checked against the date of reading. Technical details of the vulnerable code path are described here only at a high level.

Frequently asked questions

Which versions of Avada Fusion Builder are affected?

The record lists versions up to and including 3.15.2 as affected. No fixed version is named in the available data, so sites on those versions should be treated as at risk until the vendor confirms a corrected release.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV, and the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted, although the vulnerability is rated critical and does not require authentication.

What should site owners do now?

Inventory affected installations, watch for vendor updates, consider disabling the plugin on public sites where it is not essential, and review logs and file integrity for signs of compromise.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.