Unauthenticated Remote Code Execution Vulnerability in Avada Builder Plugin for WordPress

CVE-2026-6279

What is CVE-2026-6279?

The Avada Builder (fusion-builder) plugin for WordPress is susceptible to a Remote Code Execution vulnerability that allows unauthenticated attackers to exploit the system via PHP Function Injection. This issue arises from a flaw in the handling of attacker-controlled input within the Fusion_Builder_Conditional_Render_Helper::get_value() function. When the fusion_get_widget_markup AJAX endpoint is called, the lack of proper allowlist validation permits malicious users to execute arbitrary code on vulnerable websites, compromising security. The vulnerability is exacerbated as the nonce validation is weak, exposing it through the public-facing pages utilizing specific shortcode elements.

References