CVE-2022-1386: Fusion Builder WordPress plugin SSRF via unvalidated form parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, very high EPSS, and public exploit references make this an urgent patch.

What it is

Fusion Builder, a WordPress plugin used by the Avada theme, fails to validate a parameter in its forms before version 3.6.2. This lets an attacker make the server issue arbitrary HTTP requests and reflect the responses back, enabling access to internal hosts. It matters because the plugin is widely deployed through a popular commercial theme and the flaw is remotely reachable without authentication.

Impact

An attacker can use the server as a proxy to reach hosts on its local network, bypassing firewalls and access controls, and read the reflected responses. This can expose internal services and data that are not otherwise reachable from the internet.

Attack surface

Reached over the network through the plugin's form handling; the CVSS vector shows no privileges or user interaction required. Any exposed WordPress site running the affected plugin is a candidate target.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71427 (99.4th percentile) and references include an Exploit-tagged WPScan entry, indicating public exploit information exists. No ransomware association is documented.

What to do

• Update Fusion Builder to 3.6.2 or later (Avada 7.6.2 security update) immediately.
• If patching is delayed, disable or remove the Fusion Builder plugin until it can be updated.
• Restrict outbound network access from the web server to internal ranges where feasible.
• Place the WordPress site behind a WAF and block requests that attempt to supply external URLs to form parameters.
• Audit the server for signs of internal scanning or unexpected outbound requests.

Detection

• Monitor web server and application logs for form submissions containing URL-like values in Fusion Builder parameters.
• Alert on outbound HTTP requests originating from the web server to internal RFC1918 addresses or localhost.
• Review responses for reflected content from internal services returned to clients.
• Check for unexpected network connections from the WordPress host to non-standard internal ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.