CVE-2023-39311 is a high severity (CVSS 7.1) cross site request forgery flaw in the ThemeFusion Fusion Builder plugin for WordPress. It affects versions through 3.11.1. The record gives no fixed version, so confirm one with the vendor or Patchstack and update the plugin.
What's affected
The NVD record names one product: the ThemeFusion Fusion Builder plugin for WordPress, versions through 3.11.1. The record scores it 7.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H.
The weakness class is CWE-352 (cross site request forgery). The vector asks for no privileges but does need user interaction, with low impact on integrity and high on availability.
The record gives no fixed version; it only says the issue affects the product from n/a through the stated version. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check which version of the Fusion Builder plugin (also sold as Avada Builder) each WordPress site runs. With WP-CLI:
wp theme list --fields=name,status,version
wp plugin list --fields=name,status,version
You can also open Appearance, then Themes, or Plugins in the admin dashboard and read the version. Check staging and forgotten sites as well, since Avada is bundled with many purchased site templates. Then review the user list for accounts with author or higher rights that you do not recognise.
What to do now
- Inventory every site that uses Avada or Fusion Builder and note the installed versions.
- Look at the ThemeFusion release notes and the Patchstack entry for the first fixed version. The NVD record only says the issue affects versions through the stated release, so the fixed version has to be confirmed from the vendor.
- Update the theme and plugin together, since Avada and Fusion Builder ship as a pair, and test the sites after the update.
- Tell people who administer WordPress sites not to browse other sites or open links from untrusted mail in the same browser session while logged in to the dashboard, until the plugin is updated.
- Review WordPress user accounts, remove unused ones, and keep author and editor rights to people who need them.
Why it matters
Cross site request forgery tricks a logged in user's browser into sending a request that the site then treats as the user's own. The attacker does not need the user's password. They need the user to visit a page or click a link while logged in.
The vector shows user interaction is required, which is why the score is not higher. The effect in the vector is a change to data and a high availability impact. The mitigation is the vendor fix, and good habits such as logging out of admin sessions and using separate browser profiles for administration.
Quick check
Who does the attacker need to fool?
A logged in user. The vector requires user interaction, and the request runs with that user's rights.
Is this the same as the SQL injection in the same plugin?
No. CVE-2023-39309 is a separate SQL injection in Fusion Builder.
Sources
- Patchstack database entry (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description and the entry title in the URL)
- Safeguard Gold entry for CVE-2023-39311
Last reviewed: 19 October 2026.
