CVE-2026-6279

The Avada Builder plugin for WordPress contains a vulnerability that allows an attacker with no login credentials to inject and execute malicious PHP code. This occurs because the Fusion_Builder_Conditional_Render_Helper class does not properly validate user input, passing it directly to call_user_func without checking its source or legitimacy. The issue is accessible through an AJAX endpoint designed for unauthenticated users, which can be exploited by accessing any public-facing page containing certain elements.

Based on public CVE data (MITRE/NVD).