CVE-2023-39309 is a high severity (CVSS 8.5) SQL injection in the ThemeFusion Fusion Builder plugin, also known as Avada Builder, for WordPress. It affects versions through 3.11.1. The Patchstack title describes it as authenticated. Confirm the fixed version with the vendor and update.
What's affected
The NVD record names one product: the ThemeFusion Fusion Builder plugin for WordPress, versions through 3.11.1. The record scores it 8.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L.
The weakness class is CWE-89 (improper neutralization of special elements used in an SQL command). The vector asks for low privileges, with high impact on confidentiality, low on availability and none on integrity, and the scope is changed.
The record gives no fixed version; it only says the issue affects the product from n/a through the stated version. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check which version of the Fusion Builder plugin (also sold as Avada Builder) each WordPress site runs. With WP-CLI:
wp theme list --fields=name,status,version
wp plugin list --fields=name,status,version
You can also open Appearance, then Themes, or Plugins in the admin dashboard and read the version. Check staging and forgotten sites as well, since Avada is bundled with many purchased site templates. Then review the user list for accounts with author or higher rights that you do not recognise.
What to do now
- Inventory every site that uses Avada or Fusion Builder and note the installed versions.
- Look at the ThemeFusion release notes and the Patchstack entry for the first fixed version. The NVD record only says the issue affects versions through the stated release, so the fixed version has to be confirmed from the vendor.
- Update the theme and plugin together, since Avada and Fusion Builder ship as a pair, and test the sites after the update.
- If you cannot update at once, limit who can log in to the dashboard and consider a web application firewall rule set that covers SQL injection while you schedule the update.
- Review WordPress user accounts, remove unused ones, and keep author and editor rights to people who need them.
Why it matters
SQL injection means input from a user ends up inside a database query without being neutralized. The attacker can then change what the query does, often to read rows the site never meant to show. The vector here lists high confidentiality impact, which matches that picture, and a changed scope.
The plugin is part of the Avada stack, which is used on a lot of WordPress sites. A WordPress database holds user records and password hashes, so reading it is a serious step even when the attacker needs an account to start. Patch, and keep the number of accounts small.
Try it yourself
Not every flaw in a WordPress stack carries the same real risk. This demo shows how an exploitability check helps order your patch queue.
Click through it at your own pace, or open it full screen.
Quick check
Is a login needed?
The vector asks for low privileges and the Patchstack title says authenticated, so an attacker needs at least a low privilege account.
Does it affect the Avada theme?
The record lists Fusion Builder, the plugin. The theme has its own CVEs in this range, such as CVE-2023-39307.
Sources
- Patchstack database entry (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description and the entry title in the URL)
- Safeguard Gold entry for CVE-2023-39309
Last reviewed: 19 October 2026.
