WordPress - Avada (fusion) Builder - CRITICAL - CVE-2026-6279. The Avada Builder (fusion-builder) plugin for WordPress is susceptible to a Remote Code Execution vulnerability that allows unauthenticated attackers to exploit the system via PHP Function Injection. This issue arises from a flaw in the handling of attacker-controlled input within the `Fusion_Builder_Conditional_Render_Helper::get_value()` function. When the `fusion_get_widget_markup` AJAX endpoint is called, the lack of proper allowlist validation permits malicious users to execute arbitrary code on vulnerable websites, compromising security. The vulnerability is exacerbated as the nonce validation is weak, exposing it through the public-facing pages utilizing specific shortcode elements.