CVE-2026-54193
HighCVSS 7.7Summary
In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.
Risk Assessment
An attacker could exploit this vulnerability to delete critical files, potentially leading to data loss and disruption of application functionality.
Recommendation
It is recommended to update Fusion Builder to the latest version to mitigate this vulnerability.
Other vulnerabilities in Fusion Builder
See all- CVE-2026-54194Critical
Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.
- CVE-2026-56008High
The Fusion Builder plugin for WordPress versions 3.15.4 and earlier contains a privilege escalation vulnerability exploitable by contributors. An attacker with contributor role can gain unauthorized access to administrative functions.
- CVE-2026-12256High
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection. This issue affects Fusion Builder from n/a through 3.15.3.
- CVE-2025-49940Medium
Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Original NVD description (English source)
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS