Vulnerabilities / Fusion Page Builder / WPSEC-2026-2600
Fusion Page Builder <= 1.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Trashing
Medium 5.4
CWE-639Fixed in 1.7.1
- ID
- WPSEC-2026-2600
- Plugin
- Fusion Page Builder (fusion)
- Affected
- all versions before 1.7.1
- Remediation
- Update to 1.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Fusion Page Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Fusion Page Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the template delete AJAX handler in all versions up to, and including, 1.6.7 due to the capability check covering only the user-supplied 'post_id' while wp_trash_post() is called on an arbitrary, unvalidated 'template_id'. This makes it possible for authenticated attackers, with Contributor-level access and above, to trash any post or page on the site, including content authored by other users.
References
- https://wpsec.com/vuln/WPSEC-2026-2600/
- https://plugins.svn.wordpress.org/fusion/tags/1.7.1/
- https://wordpress.org/plugins/fusion/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS