Risk Letters

Exploited vulnerability

CVE-2026-6279

TLP:CLEAR

theme-fusion avada_builder Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowli

Facts

  • Vendor: theme-fusion
  • Product: avada_builder
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 9.9 %
  • First known exploitation: 13 October 2026
  • First seen by Risk Letters: 21 May 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD