Two newly disclosed vulnerabilities in the Avada Builder WordPress plugin have placed around one million sites at risk of arbitrary file read and SQL injection attacks.
According to analysis from Wordfence published on May 12, the flaws were reported by independent researcher Rafie Muhammad through the Wordfence Bug Bounty Program on March 21.
SVG Shortcode and Post Cards Flaws
The first issue, tracked as CVE-2026-4782, is an arbitrary file read flaw rated 6.5 on the Common Vulnerability Scoring System (CVSS).
It sits in the plugin’s fusion_get_svg_from_file function, which is invoked through the fusion_section_separator shortcode when a custom_svg parameter is supplied.
Because the function performs no file type or source validation, authenticated users with subscriber-level access can use it to read sensitive files on the server. These include wp-config.php, which holds WordPress’s database credentials, cryptographic keys and salts.
Read more on WordPress plugin vulnerabilities: Flaw in Slider Revolution Plugin Exposed 4m WordPress Sites
The second flaw, CVE-2026-4798, is a more severe unauthenticated time-based SQL injection in the product_order parameter, rated 7.5 (High).
Although the plugin calls sanitize_text_field() on the input, that function does not defend against SQL injection. The surrounding ORDER BY clause is concatenated into the query without using WordPress’s prepare() escaping.
The flaw is only exploitable on sites where WooCommerce was previously installed and then deactivated.
Disclosure and Patch Timeline
Wordfence shared full disclosure with the Avada team on March 24 and 25, and the vendor began work on a fix the same day.
The developer then shipped an initial patch in version 3.15.2 on April 13, followed by the complete fix in 3.15.3 on May 12.
Wordfence urged site owners to apply the update without delay. Defensive measures site administrators may also want to consider given the nature of the flaws include:
-
Auditing subscriber accounts created around the disclosure window
-
Rotating credentials stored in wp-config.php if compromise is suspected
-
Checking for unusual admin-ajax.php traffic referencing the affected shortcode
The disclosure marks the latest entry in Wordfence’s running record of Avada Builder vulnerabilities.
