CVE-2026-6279 · Avada Builder (Fusion Builder) Unauthenticated RCE via PHP Function…

01 · The Real Story

Like leaving a master key taped to the front door of 600,000 shops, with a sign saying 'use this to open the vault'

CVE-2026-6279 is an unauthenticated remote code execution flaw in the Avada Builder (fusion-builder) WordPress plugin, affecting all versions through 3.15.2. The vulnerability lives in Fusion_Builder_Conditional_Render_Helper::get_value(), where the wp_conditional_tags code path passes attacker-controlled values from a base64-decoded JSON blob directly into PHP's call_user_func() with zero allowlist validation. The only gate is a WordPress nonce (fusion_load_nonce), but this nonce is generated for user ID 0 (unauthenticated) and is printed in cleartext in the page source of any public page rendering a [fusion_post_cards] or [fusion_table_of_contents] element. Confirmed callable functions include system(), passthru(), shell_exec(), exec(), and file_get_contents(). Avada is the #1 selling WordPress theme on ThemeForest with 900,000+ active installations and 622,000+ live sites — this is an enormous, entirely internet-facing attack surface.

The vendor's CRITICAL / 9.8 score is entirely justified. Every prerequisite in the CVSS vector — network-reachable, low complexity, no privileges, no user interaction — maps perfectly to the real attack chain. The nonce 'protection' is security theatre: it's public data served to every visitor. A weaponized Python PoC has been on GitHub since May 23, 2026 — two days after disclosure — complete with interactive shell, file upload, DB recon, and reverse shell generation. Patchstack reports active mass-exploitation campaigns. We are now 128 days post-disclosure with turnkey exploit tooling publicly available; any unpatched Avada site should be treated as actively targeted.

"Unauthenticated RCE in 600K+ Avada WordPress sites. Nonce leaked in page source. Public PoC with shell. Patch now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Fingerprint Avada Builder targets at scale

The attacker identifies WordPress sites running the Avada theme and fusion-builder plugin using Wappalyzer signatures, /wp-content/plugins/fusion-builder/ path probing, or bulk Shodan/FOFA queries for Avada-specific CSS/JS class names (fusion-builder-row, fusion-post-cards). Avada's distinctive markup makes fingerprinting trivial at scale. Tooling: any web scanner, httpx, nuclei with WordPress fingerprint templates.

Conditions required:

Target runs WordPress with Avada Builder ≤ 3.15.2

Where this breaks in practice:

None — Avada's fingerprint is loud and well-documented in all major scanning tools

Detection/coverage: WAF/IDS rules for WordPress plugin enumeration (e.g., Wordfence scan detection). Most sites have no alerting on passive fingerprinting.

STEP 02

Extract leaked fusion_load_nonce from public page source

The attacker visits any public page containing a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The fusion_load_nonce value is embedded in inline JavaScript in the rendered HTML, generated for UID 0 (unauthenticated). The attacker extracts it with a simple regex: "fusion_load_nonce":"([a-f0-9]+)". This is a normal GET request indistinguishable from regular browsing. Tooling: curl + grep, or the xxconi PoC automates this.

Conditions required:

At least one public page uses Post Cards or Table of Contents element

Where this breaks in practice:

Not all Avada sites use these elements, but Post Cards and Table of Contents are among Avada's most promoted and commonly used components — a significant fraction of Avada installs expose the nonce

Detection/coverage: Virtually undetectable — this is a standard page visit. No scanner or WAF can distinguish nonce-scraping from legitimate browsing.

STEP 03

Construct base64-encoded PHP function injection payload

The attacker crafts a JSON object specifying an arbitrary PHP function and its arguments, e.g., {"type":"wp_conditional_tags","value":{"function":"system","args":"id"}}, then base64-encodes it. This is placed in the render_logics POST parameter alongside the stolen nonce and a valid widget_type (e.g., WP_Widget_Recent_Posts). The xxconi/CVE-2026-6279 GitHub repo provides a turnkey Python exploit. Tooling: xxconi/CVE-2026-6279.

Conditions required:

Valid fusion_load_nonce obtained in step 2

Where this breaks in practice:

None — payload construction is trivial; the public PoC automates it entirely

Detection/coverage: ModSecurity rules (Atomic Edge IDs 20261994/20261995) can detect the 'function' keyword and dangerous PHP function names in decoded request bodies targeting the fusion_get_widget_markup action.

STEP 04

Fire unauthenticated RCE via fusion_get_widget_markup AJAX endpoint

The attacker sends a single POST request to /wp-admin/admin-ajax.php with action=fusion_get_widget_markup, the stolen nonce, and the malicious render_logics payload. The wp_ajax_nopriv_fusion_get_widget_markup handler calls check_ajax_referer() (nonce valid — attacker has it) but performs no authentication check. Fusion_Builder_Conditional_Render_Helper::get_value() decodes the JSON and passes $decoded['function'] and $decoded['args'] directly to call_user_func(). Arbitrary PHP code executes as the web server user. Tooling: xxconi PoC, curl.

Conditions required:

Network access to /wp-admin/admin-ajax.php (open to the internet by default on all WordPress sites)

Where this breaks in practice:

None — this is a single unauthenticated POST; the complete chain from nonce extraction to RCE is 2-3 HTTP requests total

Detection/coverage: Wordfence firewall (if active and updated with CVE-2026-6279 signatures), cloud WAF rules for admin-ajax.php abuse, Nuclei template from nuclei-wordfence-cve repo.

STEP 05

Post-exploitation: webshell, credential harvest, lateral movement

With arbitrary PHP execution, the attacker writes a persistent webshell to wp-content/uploads/, reads wp-config.php for database credentials, dumps user tables (including admin password hashes), and queries the MySQL/MariaDB database for customer data. On WooCommerce sites, this includes order history, customer PII, and payment metadata. On shared hosting, the attacker may pivot to co-hosted sites. The xxconi PoC includes built-in commands for file upload/download, database reconnaissance, and reverse shell generation. Tooling: xxconi PoC interactive shell, weevely, any PHP webshell.

Conditions required:

Successful RCE from step 4

Where this breaks in practice:

PHP open_basedir or disable_functions MAY limit some post-exploitation paths, but these are not reliably configured on most WordPress hosting environments

Detection/coverage: File integrity monitoring (Wordfence file change detection, OSSEC, Tripwire), EDR/HIDS on the host, database query auditing, outbound connection monitoring for reverse shells.

03 · Compensating Control

CRITICAL 9.8→LOW 2.5

SEVERITY REDUCED

Deploy WAF rule blocking the fusion_get_widget_markup AJAX action — Add a ModSecurity, Cloudflare, or cloud WAF rule that blocks POST requests to /wp-admin/admin-ajax.php where the action parameter equals fusion_get_widget_markup. Atomic Edge published tested ModSecurity rules (IDs 20261994/20261995) that also inspect decoded request bodies for dangerous PHP function names (system|exec|shell_exec|passthru|popen|proc_open). This directly breaks step 4 of the attack path by preventing the malicious AJAX call from reaching PHP. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days.

CRITICAL 9.8→MEDIUM 5.5

SEVERITY REDUCED

Remove Post Cards and Table of Contents elements from all public pages — If [fusion_post_cards] and [fusion_table_of_contents] shortcodes are not rendered on any public page, the fusion_load_nonce is never leaked to unauthenticated visitors, breaking step 2 of the attack chain. Audit all pages, posts, and Avada templates for these elements and replace them with alternatives or remove them. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Note: this does NOT eliminate the underlying vulnerability — other future nonce leak vectors may emerge, and an attacker who finds the nonce through other means can still exploit it.

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Harden PHP with disable_functions for dangerous OS-level calls — In php.ini or .user.ini, set disable_functions = system,exec,shell_exec,passthru,popen,proc_open,pcntl_exec,proc_nice,proc_terminate. This prevents the most devastating RCE payloads from executing operating system commands. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. However, call_user_func() can still invoke PHP-native functions like file_put_contents() to write webshells or file_get_contents() to exfiltrate wp-config.php, so this is a partial mitigation only — it reduces the blast radius but does not eliminate code execution.

CRITICAL 9.8→IGNORE 0.0

SEVERITY REDUCED

Update fusion-builder to version 3.15.3 or later — The definitive fix. Version 3.15.3 replaces the open call_user_func() sink with validated switch-case logic and a function allowlist. Update via the Avada dashboard or Envato Market. Per the noisgate remediation SLA for CRITICAL, complete patching across all instances within 90 days — but given confirmed active exploitation, push the patch within days, not weeks. After patching, audit for indicators of prior compromise (webshells in wp-content/uploads/, unauthorized admin accounts, modified core files).

What doesn't work

WordPress nonce rotation — the nonce is regenerated each WordPress 'tick' (default ~12-24 hours), but the attacker extracts a fresh nonce in real-time from the page source on every visit. Rotation provides exactly zero protection against this attack.
Rate limiting on admin-ajax.php — the complete exploit chain requires only 2-3 HTTP requests. Even aggressive rate limiting (10 req/min) will not block a targeted attack. It might slow automated scanning marginally but will not prevent exploitation.
IP-based geo-blocking or country-level firewall rules — attackers operate from residential proxies, cloud VPNs, and botnets worldwide. Geographic restrictions add noise to access logs without blocking determined adversaries.
Generic WordPress security plugins without specific CVE-2026-6279 signatures — plugins like iThemes Security, All-In-One Security, or Sucuri that rely on generic heuristics may not detect the base64-encoded payload in the render_logics parameter. Only Wordfence (with updated threat intel feed) and WAF rules specifically targeting this AJAX action and payload pattern are effective.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	Active. Patchstack reports mass-exploitation campaigns targeting thousands of Avada sites regardless of size. Not yet on CISA KEV. No specific APT attribution; pattern is consistent with opportunistic WordPress exploitation by criminal operators and initial-access brokers.
Proof-of-concept availability	Weaponized PoC public since 2026-05-23 (2 days post-disclosure). GitHub repo xxconi/CVE-2026-6279 provides a Python exploit with interactive shell, file upload/download, DB reconnaissance, and reverse shell generation. Atomic Edge published WAF-focused PoC analysis with ModSecurity detection rules (IDs 20261994, 20261995). Nuclei template available via nuclei-wordfence-cve repo. Also indexed by SecureWithUmer/CVE-2026-PoCs.
EPSS score	0.02387 (2.4%, ~83rd percentile) — moderate for a CRITICAL with active exploitation, suggesting the EPSS model hasn't fully weighted the weaponized PoC and confirmed mass-scanning campaigns.
CISA KEV status	Not listed as of 2026-09-27. Given Patchstack's active exploitation reports, KEV inclusion may be pending or may never come due to CISA's federal-system focus.
CVSS vector breakdown	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` (9.8) — every base metric at maximum severity except Scope. AV:N = internet-reachable. AC:L = no special conditions. PR:N = unauthenticated (the leaked nonce makes this accurate). UI:N = no victim click needed. Full CIA impact. Patchstack independently scored this a 10.0.
Affected versions	Avada Builder (fusion-builder) ≤ 3.15.2. The plugin is bundled with the Avada theme (ThemeFusion) and is not available on WordPress.org — updates must come through the Avada dashboard or Envato Market, which often delays patch adoption.
Fixed version	3.15.3 — released May 2026. The fix replaces the open `call_user_func()` sink with validated switch-case logic and a function allowlist. No distro backports applicable (commercial plugin, single update channel).
Installed base / exposure	900,000+ active installations, 622,220+ live sites detected (wp.md, August 2026), 4,953 sites in the Tranco top 1M. Avada holds ~4% WordPress theme market share and has sold 1,069,561 copies. All installations are internet-facing by definition. Avada is the #1 selling WordPress theme for 14+ consecutive years.
Disclosure timeline	Disclosed 2026-05-21. PoC published 2026-05-23. Patch (3.15.3) available same week. Now 128 days post-disclosure with active exploitation ongoing. YouTube walkthroughs available since May 2026.
Credited researcher	Not publicly attributed. Listed as N/A on both Patchstack and WPScan. Wordfence threat intel references the finding but does not name the reporter.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Zero meaningful friction in the attack chain. The complete exploit requires exactly 2-3 HTTP requests: one GET to scrape the nonce from public HTML, one POST to execute arbitrary PHP. No authentication, no user interaction, no race condition, no special configuration, no brute-forcing. The nonce 'protection' is security theatre — it's printed in cleartext on public pages for any visitor to read. Every friction point in this chain rounds to zero.
Weaponized PoC with interactive shell available for 128+ days. The xxconi/CVE-2026-6279 GitHub repository provides a turnkey Python exploit with reverse shell, file operations, and database reconnaissance built in. Atomic Edge published ModSecurity rules specifically because exploitation is automated at scale. The bar for exploitation is 'can run a Python script.'
Massive, entirely internet-facing attack surface with no choke point. 900,000+ active installations, every single one internet-facing by definition (WordPress is a web CMS). Unlike infrastructure CVEs that require VPN/internal network access, every Avada site's /wp-admin/admin-ajax.php is directly reachable from the public internet. No corporate firewall, VPN, or network segmentation stands between the attacker and the vulnerable endpoint.
Active mass exploitation confirmed by Patchstack. Campaigns are targeting thousands of sites regardless of size. Combined with the 128-day exposure window and weaponized tooling, the long tail of unpatched sites is being systematically harvested for webshells, credential theft, and initial-access brokering.
Role multiplier: WordPress with Avada Builder is a web CMS/page builder — not a canonical high-value infrastructure component (not an IdP, DC, hypervisor, CI/CD, or network edge). Deployment roles: (a) *Low-value:* personal blogs, portfolio sites — blast radius is host-level (webshell, defacement); chain succeeds fully. (b) *Typical:* business marketing/corporate sites — blast radius extends to database credential theft (wp-config.php), admin account takeover, potential pivot to internal networks if the WordPress host has LAN access; chain succeeds fully. (c) *High-value:* WooCommerce stores — Avada heavily markets its WooCommerce integration, and an estimated 20-30%+ of Avada deployments run WooCommerce. On these sites, the blast radius reaches mass data egress: order history, customer PII (names, addresses, emails, phone numbers), payment metadata, and full admin takeover. This high-value role clearly represents ≥1% of the installed base, establishing a severity floor of HIGH. The additional factors — unauthenticated access, zero friction, weaponized PoC, active mass exploitation, 128-day exposure — push the final verdict well above the floor to CRITICAL.

Why not higher?

The CVSS vector is already 9.8 — the maximum possible without a Scope change to S:C. A 10.0 would require the vulnerability to break out of the WordPress application's security scope to impact other independent components (e.g., hypervisor escape, container breakout). While post-exploitation can absolutely pivot to databases and shared-hosting neighbors, the initial RCE is contained to the web server process's OS-level privileges (typically www-data), not a sandbox or hypervisor escape. 9.8 is the correct ceiling for this class of vulnerability.

Why not lower?

Every potential downward pressure fails scrutiny. The nonce requirement is not real friction — it is leaked in public HTML to unauthenticated visitors. The shortcode prerequisite (Post Cards or ToC must be on a public page) is the only genuine narrowing, but these are among Avada's most promoted and commonly used elements, so this does not meaningfully reduce the reachable population. No authentication is required. The entire target population is internet-facing. A weaponized PoC has been public for over four months. Active mass exploitation is confirmed. There is no defensible argument for anything below CRITICAL.

06 · Verification

Crowdsourced verification payload.

Run this script on each WordPress host via SSH or your configuration management tool (Ansible, Salt, etc.). Usage: bash check_cve_2026_6279.sh /var/www/html — pass the WordPress root directory as the first argument (defaults to /var/www/html). Requires read access to the wp-content/plugins/ directory; no root privileges needed.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# CVE-2026-6279 Checker — Avada Builder (fusion-builder) version audit
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
set -euo pipefail

WP_PATH="${1:-/var/www/html}"
PLUGIN_FILE="$WP_PATH/wp-content/plugins/fusion-builder/fusion-builder.php"
FIXED_VERSION="3.15.3"

if [ ! -d "$WP_PATH/wp-content" ]; then
    echo "UNKNOWN — $WP_PATH does not appear to be a WordPress installation."
    exit 2
fi

if [ ! -f "$PLUGIN_FILE" ]; then
    echo "UNKNOWN — fusion-builder plugin not found at $PLUGIN_FILE (not installed or different path)."
    exit 2
fi

# Extract version from the plugin file header
VERSION=$(grep -i '^[[:space:]]*\*[[:space:]]*Version:' "$PLUGIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
    echo "UNKNOWN — could not extract version from $PLUGIN_FILE."
    exit 2
fi

echo "[CVE-2026-6279] fusion-builder detected: version $VERSION"
echo "[CVE-2026-6279] fixed in: >= $FIXED_VERSION"

# Version comparison using sort -V
SMALLER=$(printf '%s\n' "$FIXED_VERSION" "$VERSION" | sort -V | head -n1)

if [ "$SMALLER" = "$FIXED_VERSION" ]; then
    # installed version >= fixed version
    echo "PATCHED — fusion-builder $VERSION >= $FIXED_VERSION."
    exit 0
else
    echo "VULNERABLE — fusion-builder $VERSION < $FIXED_VERSION (CVE-2026-6279)."
    # Bonus: check if the nonce-leaking shortcodes are in use
    echo "[*] Scanning for nonce-leaking shortcodes in content..."
    if grep -rql 'fusion_post_cards\|fusion_table_of_contents' "$WP_PATH/wp-content/" 2>/dev/null; then
        echo "WARNING — [fusion_post_cards] or [fusion_table_of_contents] shortcodes detected. Nonce is likely exposed on public pages."
    else
        echo "INFO — Nonce-leaking shortcodes not found in wp-content (may still be in database/posts)."
    fi
    exit 1
fi