An unauthenticated attacker can inject arbitrary PHP code into the Avada (Fusion) Builder plugin for WordPress up to version 3.15.2. The plugin decodes a base64-encoded JSON payload from the 'render_logics' shortcode attribute and passes it directly to PHP's call_user_func without any validation, enabling command execution. The vulnerability is triggered through the fusion_get_widget_markup AJAX endpoint, which is registered for non‑privileged users and protected only by a nonce that is deterministic and exposed to any visitor of a page containing certain shortcodes. As a result, anyone can craft a request that executes malicious code on the site. A successful exploitation compromises the confidentiality, integrity, and availability of the entire WordPress installation, allowing an attacker to install malware, exfiltrate data, and seize control of the host.

Any WordPress website running the Avada (Fusion) Builder plugin version 3.15.2 or older is affected. The vulnerability applies to all installations that expose the fusion_get_widget_markup endpoint, typically sites that use the Plugin’s Post Cards or Table of Contents shortcodes. Only the plugin itself is affected; the core WordPress installation is not directly vulnerable. Site administrators should verify the plugin version and update if they are still using a vulnerable release.

The CVSS score of 9.8 indicates critical severity, and the vulnerability is exploitable by unauthenticated users. EPSS data is not available, but the deterministic nature of the nonce and its exposure in public page JavaScript suggests that the attack surface is wide. The vulnerability is not listed in the CISA KEV catalog, but its high impact makes it a priority for remediation.