CVE-2026-54193: WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability

Synopsis

An arbitrary file deletion vulnerability affects the Fusion Builder WordPress plugin at version 3.15.4 and earlier. The flaw is reachable over the network and requires only a low-privilege (contributor-level) account to exploit, with no victim interaction needed. Successful exploitation allows an attacker to delete arbitrary files on the server, which can destroy application data, remove configuration files, or render the site unavailable. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account is sufficient; specifically, a contributor-level WordPress account is all that is needed to trigger the file deletion.

• Victim interactionNot required

  The attacker does not need to trick any other user into performing an action; the exploit is self-contained.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory-layout dependencies, or other environmental factors to succeed.

Blast Radius

• Attacker deletes arbitrary files on the server, including WordPress core files, theme files, or plugin files, breaking site functionality.
• Critical configuration files such as wp-config.php can be removed, exposing database credentials or making the site unrecoverable without a backup restore.
• Deletion of key files causes the site to go fully offline, resulting in a sustained denial of service for end users.
• Because the CVSS scope is Changed (S:C), impact extends beyond the WordPress application itself and can affect other resources or services sharing the same host filesystem.