Skip to content
Threat Feed

Product

Avada Builder (Fusion-Builder) Plugin <= 3.15.2

1 brief RSS
critical advisory

CVE-2026-6279 - Avada Builder Plugin Unauthenticated RCE via PHP Function Injection

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to unauthenticated remote code execution (RCE) due to PHP function injection, allowing attackers to execute arbitrary code on affected sites.

Avada Builder wordpress rce php function-injection cve-2026-6279
2r 1t 1c