Fusion Builder

Fusion Builder is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated contributor account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.15.4.

Avada Builder permits unauthenticated arbitrary file deletion through maybe_delete_files(). A published Avada form must save entries to the database; path-traversal input to fusion_form_submit_ajax plus attacker-controlled fusion_privacy_expiration_interval and privacy_expiration_action fields triggers immediate deletion cleanup through Fusion_Form_DB_Privacy without administrator interaction. Deleting a suitable file, such as wp-config.php, can enable subsequent code execution; file deletion alone is not unconditional code execution. Published affected versions: <= 3.15.3.

Fusion Builder is affected by arbitrary file deletion. Exploitation requires an authenticated contributor account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 3.15.4.

Fusion Builder is affected by code execution. Exploitation requires an authenticated contributor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 3.15.4.

Avada Builder permits unauthenticated PHP function injection through fusion_get_widget_markup: attacker-controlled base64-decoded JSON reaches call_user_func() in the wp_conditional_tags branch of Fusion_Builder_Conditional_Render_Helper::get_value() without an allowlist. Exploitation requires fusion_load_nonce, exposed for user ID 0 by a public page containing Post Cards or Table of Contents, and can execute arbitrary code on the server. Published affected versions: <= 3.15.2.

Fusion Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through < 3.15.0.

Fusion Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Fusion Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Fusion Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fusion Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fusion Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Fusion Builder is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Fusion Builder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Fusion Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fusion Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.