CVE Database /
CVE-2026-54194
CVE · Critical
CVE-2026-54194 — Fusion Builder [fusion-builder] < 3.15.5
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-54194
|
Fusion Builder [fusion-builder] < 3.15.5 |
Deserialization of Untrusted Data |
Critical
9.8
|
< 3.15.5
|
3.15.5 |
2026-06-15 |
—
|
CVE-2026-54194
The Avada Builder plugin for WordPress contains a vulnerability that allows attackers with contributor-level access and above to inject malicious PHP objects through untrusted input in versions up to 3.15.4. This flaw can be exploited to introduce additional vulnerabilities if other plugins or themes are installed on the affected system, potentially enabling file deletion, data retrieval, or code execution.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings