Vulnary
← back to the feed
Critical· 9.8

CVE-2026-6279

The Avada Builder (fusion-builder) plugin for WordPress allows attackers to run any PHP code on a site without needing to log in. The flaw is in how the plugin processes data from an AJAX endpoint, letting an attacker inject a function name that is then executed. This can happen on any public page that uses certain plugin elements.

publishedMay 21, 2026
last modifiedJul 23, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
2%
80th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 6, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

WordPress sites that use the Avada Builder (fusion-builder) plugin, versions up to and including 3.15.2.

02

Real-world impact

An attacker could take full control of the affected WordPress site, install malware, steal sensitive data, deface the site, or use it as a launch point for further attacks.

03

Why this severity

The CVSS score of 9.8 reflects that the vulnerability can be exploited by anyone on the internet (no authentication required), has low complexity, and gives the attacker complete control over the system, affecting confidentiality, integrity, and availability.

04

What to do about it

no official fix yet

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

  1. May 21, 2026 · May 21, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 23, 2026 · 12d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →