CVE-2026-54194: WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-supplied data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and chain them into destructive actions. In Fusion Builder (a WordPress plugin by ThemeFusion) at versions 3.15.4 and below, this flaw is reachable over the network with no authentication required, meaning any internet-accessible WordPress site running the affected plugin is exposed. Successful exploitation grants the attacker full read, write, and availability impact on the affected application. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can send a crafted request from anywhere on the internet without requiring local or adjacent-network access.

• AuthenticationNot required

  No account or session credential is needed to trigger the vulnerability; any unauthenticated HTTP request is sufficient.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required; the attacker exploits the service directly.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions, specific memory layouts, or environmental prerequisites standing between the attacker and a successful payload.

Blast Radius

• Reads any file readable by the web server process, including wp-config.php credentials, stored session tokens, and customer records in the database.
• Writes or overwrites arbitrary files on the server, enabling the attacker to plant a web shell or modify plugin and theme code.
• Executes arbitrary PHP code through gadget-chain exploitation, giving the attacker full remote code execution on the host container.
• Crashes or degrades the WordPress application by corrupting persistent state or exhausting resources through crafted object graphs.