CVE-2026-12256
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection. This issue affects Fusion Builder from n/a through 3.15.3.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious code or take control of a WordPress site.
Recommendation
Upgrade Fusion Builder to a version newer than 3.15.3 if available, or apply other mitigations recommended by the vendor.
Other vulnerabilities in Fusion Builder
See all- CVE-2026-54194Critical
Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.
- CVE-2026-56008High
The Fusion Builder plugin for WordPress versions 3.15.4 and earlier contains a privilege escalation vulnerability exploitable by contributors. An attacker with contributor role can gain unauthorized access to administrative functions.
- CVE-2026-54193High
In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.
- CVE-2025-49940Medium
Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS