themefusion Avada Builder Plugin up to 3.15.2 on WordPress AJAX Endpoint get_value injection

Summaryinfo

A vulnerability has been found in themefusion Avada Builder Plugin up to 3.15.2 on WordPress and classified as critical. This vulnerability affects the function Fusion_Builder_Conditional_Render_Helper::get_value of the component AJAX Endpoint. Performing a manipulation results in injection. This vulnerability was named CVE-2026-6279. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in themefusion Avada Builder Plugin up to 3.15.2 on WordPress. It has been classified as critical. This affects the function Fusion_Builder_Conditional_Render_Helper::get_value of the component AJAX Endpoint. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.

The weakness was presented by Tin Pham, Trong Pham and Hao Ngo. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-6279 since 04/14/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 3.15.0 eliminates this vulnerability. The upgrade is hosted for download at avada.com.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202605-4661). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• themefusion

Name

• Avada Builder Plugin

Version

• 3.15.0
• 3.15.1
• 3.15.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion