Unauthenticated PHP function injection to RCE in Avada Builder via fusion_get_widget_markup (CVE-2026-6279)
Five public exploits are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13; an Avada site still on Fusion Builder 3.15.2 or earlier is exploitable with a single unauthenticated request.
The wp_conditional_tags case in Fusion_Builder_Conditional_Render_Helper::get_value() passes attacker-controlled values from a base64-decoded JSON blob straight to call_user_func() with no allowlist. Because the fusion_get_widget_markup AJAX action is registered for unauthenticated users, anyone can call arbitrary PHP functions and execute code on the server.
Affected: Avada (Fusion) Builder (fusion-builder) <= 3.15.2
How to Test
In WordPress Admin > Plugins (or the Avada dashboard), confirm the Avada Builder / fusion-builder version; 3.15.2 and earlier are affected. Review access logs for unauthenticated requests to wp-admin/admin-ajax.php with action=fusion_get_widget_markup carrying base64-encoded JSON that includes wp_conditional_tags, and check the server for newly created PHP files, modified theme files, or unknown administrator accounts.
How to Patch
Update Avada Builder to the latest release later than 3.15.2 through the Avada theme updater or ThemeFusion account. If you cannot update immediately, block requests to admin-ajax.php with action=fusion_get_widget_markup at the WAF until you can.