Avada Builder WordPress plugin suffers critical flaws enabling credential theft and data breaches

On March 21 2026, security researchers uncovered two severe vulnerabilities in Avada Builder, a popular WordPress plugin with roughly one million active installations worldwide. The first flaw, CVE‑2026‑4782 (CVSS 6.5), permits authenticated users with subscriber-level access or higher to read arbitrary files through the custom_svg parameter of the fusion_section_separator shortcode. The second, CVE‑2026‑4798 (CVSS 7.5), is a time‑based SQL injection that can be triggered by unauthenticated visitors if WooCommerce was previously active, via the product_order parameter. Together, these flaws expose site owners to credential theft, data exfiltration, and potential full site compromise.

The vulnerabilities were identified by Rafie Muhammad, who received $3,386.00 for the file‑read issue and $1,067.00 for the SQL injection. Avada’s response was swift: the first patch was released on April 13 2026, addressing the file‑read vector, followed by a second patch on May 12 2026 that closed the SQL injection. The fully patched version, 3.15.3, was made available thereafter. In parallel, Wordfence deployed firewall rules on March 25 to block both exploits, extending free‑user protection on April 24.

While the second article details the technical aspects and remediation timeline, the first article—though lacking full content—highlighted the potential for site credential theft stemming from these flaws. Together, the reports underscore the importance of timely updates for high‑traffic plugins and the role of security researchers in safeguarding the WordPress ecosystem. Site administrators are urged to upgrade to version 3.15.3 immediately and to review any custom SVG or WooCommerce integrations that might still be vulnerable.