CVE-2026-54194
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.
Risk Assessment
Organizations using vulnerable versions may be exposed to attacks that could result in data loss or security breaches.
Recommendation
It is recommended to update Fusion Builder to the latest version to mitigate this vulnerability.
Other vulnerabilities in Fusion Builder
See all- CVE-2026-54193High
In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.
- CVE-2026-56008High
The Fusion Builder plugin for WordPress versions 3.15.4 and earlier contains a privilege escalation vulnerability exploitable by contributors. An attacker with contributor role can gain unauthorized access to administrative functions.
- CVE-2026-12256High
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection. This issue affects Fusion Builder from n/a through 3.15.3.
- CVE-2025-49940Medium
Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Original NVD description (English source)
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS