CVE

CVE-2022-1386

9.8

CVSS

Description

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.

Attack Vector

Privileges Req.

User Interaction

fusion builder

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2022-1386 Scanner

CVE-2022-1386 scanner - Server-Side Request Forgery (SSRF) vulnerability in Fusion Builder plugin for Wordpress

Used 3.4k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: fusion builder

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →