CVE-2026-6279 Code injection in Avada (Fusion) Builder
Unauthenticated attackers can execute arbitrary code on WordPress sites using the Avada Builder plugin by injecting PHP functions via a shortcode attribute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6279?
CVE-2026-6279 is a critical code injection vulnerability in themefusion Avada (Fusion) Builder, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.
Weakness: CWE-74
Which versions are affected by CVE-2026-6279?
How do I fix CVE-2026-6279?
No fix has been published for CVE-2026-6279 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-6279 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6279 exists.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Sources
Also known as GHSA-f53p-382v-8pj7.