Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection

The Avada Builder fusion-builder plugin for WordPress versions = 3.15.2 is vulnerable to unauthenticated remote code execution via PHP function injection. The fusiongetwidgetmarkup AJAX action is registered for unauthenticated users wpajaxnoprivfusiongetwidgetmarkup and is gated only by...