CVE-2022-1386

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.

• CWE-918

• https://theme-fusion.com/version-7-6-2-security-update/Patch, Release Notes, Third Party Advisory
• https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536bExploit, Third Party Advisory
• https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/Patch, Third Party Advisory
• https://theme-fusion.com/version-7-6-2-security-update/Patch, Release Notes, Third Party Advisory
• https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536bExploit, Third Party Advisory
• https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/Patch, Third Party Advisory

Published

May 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1380Stored Cross Site Scripting vulnerability in Item name param…5.4
• CVE-2022-1381global heap buffer overflow in skip_range in GitHub reposito…7.8
• CVE-2022-1382NULL Pointer Dereference in GitHub repository radareorg/rada…5.5
• CVE-2022-1383Heap-based Buffer Overflow in GitHub repository radareorg/ra…6.1
• CVE-2022-1384Mattermost version 6.4.x and earlier fails to properly check…8.8
• CVE-2022-1385Mattermost 6.4.x and earlier fails to properly invalidate pe…4.6
• CVE-2022-1387The No Future Posts WordPress plugin through 1.4 does not es…4.8
• CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…9.8
• CVE-2022-1389On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, a…4.3
• CVE-2022-1390The Admin Word Count Column WordPress plugin through 2.2 doe…9.8
• CVE-2022-1391The Cab fare calculator WordPress plugin before 1.0.4 does n…9.8
• CVE-2022-1392The Videos sync PDF WordPress plugin through 1.7.4 does not …7.5