Avada Builder Flaws Expose One Million WordPress Sites
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-4782 | The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' func The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3. NVD description · AI analysis pending | 6.5 | <1% |
| — | ||
| CVE-2026-4798 | The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated. NVD description · AI analysis pending | 7.5 | <1% |
| — |
Full article334 words · extracted from infosecurity-magazine.com · click to collapse
Two newly disclosed vulnerabilities in the Avada Builder WordPress plugin have placed around one million sites at risk of arbitrary file read and SQL injection attacks.
According to analysis from Wordfence published on May 12, the flaws were reported by independent researcher Rafie Muhammad through the Wordfence Bug Bounty Program on March 21.
SVG Shortcode and Post Cards Flaws
The first issue, tracked as CVE-2026-4782, is an arbitrary file read flaw rated 6.5 on the Common Vulnerability Scoring System (CVSS).
It sits in the plugin's fusion_get_svg_from_file function, which is invoked through the fusion_section_separator shortcode when a custom_svg parameter is supplied.
Because the function performs no file type or source validation, authenticated users with subscriber-level access can use it to read sensitive files on the server. These include wp-config.php, which holds WordPress's database credentials, cryptographic keys and salts.
The second flaw, CVE-2026-4798, is a more severe unauthenticated time-based SQL injection in the product_order parameter, rated 7.5 (High).
Although the plugin calls sanitize_text_field() on the input, that function does not defend against SQL injection. The surrounding ORDER BY clause is concatenated into the query without using WordPress's prepare() escaping.
The flaw is only exploitable on sites where WooCommerce was previously installed and then deactivated.
Disclosure and Patch Timeline
Wordfence shared full disclosure with the Avada team on March 24 and 25, and the vendor began work on a fix the same day.
The developer then shipped an initial patch in version 3.15.2 on April 13, followed by the complete fix in 3.15.3 on May 12.
Wordfence urged site owners to apply the update without delay. Defensive measures site administrators may also want to consider given the nature of the flaws include:
-
Auditing subscriber accounts created around the disclosure window
-
Rotating credentials stored in wp-config.php if compromise is suspected
-
Checking for unusual admin-ajax.php traffic referencing the affected shortcode
The disclosure marks the latest entry in Wordfence's running record of Avada Builder vulnerabilities.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/avada-builder-flaws-one-million/