The Avada Builder

CVE-2026-6279 is a PHP function-injection bug in Avada Builder (fusion-builder) affecting versions <= 3.15.2, fixed in 3.15.3. The vulnerable path takes attacker-controlled data from a base64-decoded JSON blob, feeds it into call_user_func(), and reaches it through the unauthenticated fusion_get_widget_markup AJAX handler. On paper that is classic pre-auth RCE with full site compromise potential.

The vendor's 9.8/CRITICAL score is technically defensible, but operationally a bit hot. The deciding friction is that the endpoint is protected by a nonce which, per Wordfence, becomes harvestable only when a public page exposes JavaScript for specific Avada elements like Post Cards or Table of Contents. That means this is not 'every vulnerable host on the internet falls over instantly'; it's still very serious, but real-world reach is narrower than a generic unauthenticated RCE.

Why this verdict

• Start at 9.8: vendor scoring is reasonable because the sink is pre-auth network RCE with full impact.
• Downward adjustment for prerequisite exposure: the attacker does not just need a vulnerable plugin; they need a public page that leaks the nonce through specific Avada elements. That is a real deployment filter, not paperwork.
• No post-initial-access friction: no credentials, no internal foothold, and no victim click are required once the nonce is obtainable, so this stays well above MEDIUM.
• Large blast radius on successful compromise: WordPress/PHP code execution usually means database access, credential theft, content tampering, webshells, and pivot potential from a public web tier.
• Current threat signals are soft: no KEV listing, low EPSS, and no strong primary-source evidence of live exploitation keep this out of CRITICAL-for-everyone territory.

Why not higher?

I am not calling this CRITICAL because the exploit chain is narrower than the raw CVSS suggests. The nonce must be exposed through specific public Avada elements, and that requirement materially reduces the reachable population. With no KEV listing or credible evidence of broad exploitation yet, 'patch immediately within hours' is not justified for every estate.

Why not lower?

I am not pushing this to MEDIUM because the attacker still needs no auth and no user interaction. When the prerequisites are met, the outcome is full code execution on an internet-facing CMS component that commonly sits in production DMZs and marketing sites with business-critical data and credentials.

1. Block the vulnerable AJAX action at the edge — Add a WAF or reverse-proxy rule to deny or tightly challenge requests to wp-admin/admin-ajax.php carrying action=fusion_get_widget_markup from untrusted clients. Do this as the primary temporary control and deploy it within 30 days if patching cannot complete first.
2. Hunt for public nonce exposure — Enumerate Avada sites and identify pages rendering Post Cards or Table of Contents elements, because those are the reachability amplifiers Wordfence called out. Use that output to prioritize exposed internet sites first and complete the review within 30 days.
3. Tighten web-tier file integrity monitoring — Alert on new or modified PHP under wp-content/plugins, wp-content/themes, uploads directories, and drop-in files. This will not stop initial exploitation, but it does catch the common persistence step; deploy within 30 days.
4. Constrain PHP write paths — Where architecture allows, reduce PHP's ability to write to plugin and theme directories, or move sites to immutable deploy patterns. This shrinks post-exploitation persistence even if the bug lands; implement within 30 days on high-value internet-facing sites.
5. Increase logging on admin-ajax.php — Capture full request metadata, response codes, source IPs, and user agents for WordPress AJAX endpoints, especially fusion_get_widget_markup. This improves detection and retrospective scoping; enable within 30 days.

Run this on the target WordPress host as a user with read access to the web root; root is not required unless filesystem permissions are tight. Invoke it as bash check-avada-cve-2026-6279.sh /var/www/html or point it at a higher-level web directory; it will search for fusion-builder/fusion-builder.php, read the plugin version, and print VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-avada-cve-2026-6279.sh
# Detects whether Avada Builder (fusion-builder) is vulnerable to CVE-2026-6279
# Affected: <= 3.15.2
# Fixed:    >= 3.15.3
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / plugin not found / could not parse

set -u

TARGET_ROOT="${1:-.}"
AFFECTED_MAX="3.15.2"

if ! command -v find >/dev/null 2>&1; then
  echo "UNKNOWN - required command 'find' not available"
  exit 2
fi

PLUGIN_FILE="$(find "$TARGET_ROOT" -type f -path '*/wp-content/plugins/fusion-builder/fusion-builder.php' 2>/dev/null | head -n 1)"

if [ -z "$PLUGIN_FILE" ]; then
  # Try a broader fallback for non-standard layouts
  PLUGIN_FILE="$(find "$TARGET_ROOT" -type f -name 'fusion-builder.php' 2>/dev/null | grep '/fusion-builder/' | head -n 1)"
fi

if [ -z "$PLUGIN_FILE" ]; then
  echo "UNKNOWN - fusion-builder plugin file not found under $TARGET_ROOT"
  exit 2
fi

VERSION_LINE="$(grep -iE '^\s*Version\s*:' "$PLUGIN_FILE" 2>/dev/null | head -n 1)"
VERSION="$(printf '%s' "$VERSION_LINE" | sed -E 's/^\s*Version\s*:\s*//I' | tr -d '\r' | xargs)"

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not parse plugin version from $PLUGIN_FILE"
  exit 2
fi

compare_with_php() {
  php -r '
    $v=$argv[1];
    $max=$argv[2];
    if (version_compare($v, $max, "<=")) { exit(1); }
    exit(0);
  ' "$1" "$2"
}

compare_with_sortv() {
  local lowest
  lowest="$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n 1)"
  [ "$lowest" = "$1" ]
}

IS_VULN=2
if command -v php >/dev/null 2>&1; then
  if compare_with_php "$VERSION" "$AFFECTED_MAX"; then
    IS_VULN=0
  else
    rc=$?
    if [ "$rc" -eq 1 ]; then
      IS_VULN=1
    fi
  fi
else
  if compare_with_sortv "$VERSION" "$AFFECTED_MAX"; then
    IS_VULN=1
  else
    IS_VULN=0
  fi
fi

case "$IS_VULN" in
  1)
    echo "VULNERABLE - Avada Builder version $VERSION detected at $PLUGIN_FILE (affected <= $AFFECTED_MAX)"
    exit 1
    ;;
  0)
    echo "PATCHED - Avada Builder version $VERSION detected at $PLUGIN_FILE (fixed >= 3.15.3)"
    exit 0
    ;;
  *)
    echo "UNKNOWN - comparison failed for version $VERSION at $PLUGIN_FILE"
    exit 2
    ;;
esac

Sources

1. Wordfence vulnerability record
2. Avada 7.15.3 security update
3. WPScan plugin vulnerability page
4. CISA KEV catalog
5. FIRST EPSS API documentation
6. CIRCL vulnerability record for CVE-2026-6279
7. Avada product footprint / customer base
8. GitHub Advisory Database