CVE-2026-54194: WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
Published Jun 16, 2026
·Updated
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
Affected Software
1 affected component
ThemeFusion Fusion Builder<=3.15.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Fusion Builder Pluginto a version that resolves this vulnerability.Fixed in 3.15.5
Event History
Jun 16, 2026
CVE Published
via MITRE·08:56 PM
Data Sourced
via MITRE·08:56 PM
RemedyDescriptionSeverityWeakness
Jun 17, 2026
Data Sourced
via NVD·01:20 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-54194?
CVE-2026-54194 has a critical severity rating of 9.8.
2
What vulnerability is associated with CVE-2026-54194?
CVE-2026-54194 is a PHP Object Injection vulnerability in the Fusion Builder plugin versions up to 3.15.4.
3
How do I fix CVE-2026-54194?
To mitigate CVE-2026-54194, update the Fusion Builder plugin to the latest version beyond 3.15.4.
4
What impact does CVE-2026-54194 have on user data?
CVE-2026-54194 can lead to compromised confidentiality, integrity, and availability of user data due to PHP Object Injection.
5
Is CVE-2026-54194 a vulnerability that affects all users?
CVE-2026-54194 affects all users of the Fusion Builder plugin version 3.15.4 and earlier, particularly those with inadequate security measures.