Fusion Builder versions up to 3.15.4 allow an authenticated contributor to elevate privileges to that of an administrator. The flaw resides in the plugin’s permission handling, giving the attacker control over site settings and content creation with administrative rights. This increases the overall attack surface and could enable full site takeover.

Any WordPress installation that includes the ThemeFusion Fusion Builder plugin version 3.15.4 or earlier. These sites are vulnerable until the plugin is updated to 3.15.5 or later.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, so the exact exploitation likelihood is unknown, but the flaw is actively exploitable by any contributor role. The vulnerability is not listed in CISA KEV, though its high score warrants urgent action.