Executive Summary

The Avada Builder (fusion-builder) plugin for WordPress has a vulnerability that allows unauthenticated remote code execution via PHP function injection. This occurs because the plugin's Fusion_Builder_Conditional_Render_Helper::get_value() method uses attacker-controlled data from a base64-decoded JSON blob directly in a call_user_func() call without validating the function being called. Attackers can exploit this through the fusion_get_widget_markup AJAX endpoint, which is accessible to unauthenticated users and protected only by a nonce that is deterministically exposed on public pages containing certain elements, allowing arbitrary code execution on affected sites.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows unauthenticated attackers to execute arbitrary code on your WordPress site. This can lead to full site compromise, including data theft, site defacement, installation of malware, or use of the site as a platform for further attacks. Because the exploit requires no authentication and has a high severity score (CVSS 9.8), it poses a critical risk to affected sites.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote code execution on affected WordPress sites using the Avada Builder plugin. This can lead to full compromise of the site, including unauthorized access to sensitive data.

Such a compromise can result in violations of common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data. If attackers exploit this vulnerability to access or manipulate protected data, the affected organization could face compliance breaches, legal consequences, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects Avada Builder (fusion-builder) plugin versions up to and including 3.15.2. Immediate mitigation involves updating the plugin to a version later than 3.15.2 where this issue is fixed.

Since the latest Avada version as of March 17, 2026 is 7.15.1, ensure your Avada Builder plugin is updated to the latest available version to address this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your WordPress site is running the Avada Builder (fusion-builder) plugin version 3.15.2 or earlier, as these versions are vulnerable to unauthenticated remote code execution.

To detect exploitation attempts on your system or network, you can monitor HTTP requests to the AJAX endpoint `wp_ajax_nopriv_fusion_get_widget_markup`. Suspicious requests to this endpoint, especially those containing base64-encoded JSON blobs or unusual parameters, may indicate exploitation attempts.

Suggested commands to help detect the vulnerability or exploitation attempts include:

• Use curl or wget to check the plugin version by requesting the plugin's readme or changelog files if accessible.
• Use grep or similar tools to search your WordPress installation for the plugin version, e.g., `grep -r 'Version: 3.15.2' wp-content/plugins/fusion-builder/`.
• Monitor web server logs for requests to `admin-ajax.php` with the parameter `action=fusion_get_widget_markup`, for example: `grep 'action=fusion_get_widget_markup' /var/log/apache2/access.log`.
• Use network monitoring tools or intrusion detection systems to alert on suspicious AJAX requests containing base64-encoded payloads targeting this endpoint.

Useful 0 Not Useful 0