CVE-2026-12256: falha de alta gravidade em ThemeFusion Fusion Builder
WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.5%
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ThemeFusion · Fusion BuilderCVEs relacionadas — ThemeFusion Fusion Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2023-39309HIGHWordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerabilityEPSS 0.7%CVE-2023-39310MEDIUMWordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-56008HIGHWordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-39306HIGHWordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-54194CRITICALWordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-54193HIGHWordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerabilityEPSS 0.3%