1 Million WordPress Websites Exposed by Avada Builder Security Vulnerabilities

A widely used WordPress plugin powering over one million websites has been found vulnerable to two serious security flaws that could expose sensitive data and server files.

Security researchers warn that the issues in the Avada Builder plugin could allow both authenticated and unauthenticated attackers to compromise affected sites.

The vulnerabilities, discovered by researcher Rafie Muhammad through the Wordfence Bug Bounty Program, include an arbitrary file read flaw (CVE-2026-4782) and a SQL injection vulnerability (CVE-2026-4798).

Together, these weaknesses significantly increase the attack surface for WordPress sites using the popular builder plugin.

WordPress Websites Exposed

The first vulnerability affects Avada Builder versions up to 3.15.2 and carries a CVSS score of 6.5. It allows authenticated users, even those with low-level subscriber access, to read arbitrary files from the server.

The issue stems from improper validation in the plugin’s fusion_get_svg_from_file() function. This function is designed to fetch SVG files for rendering visual elements, but fails to restrict file types or sources.

As a result, attackers can manipulate the custom_svg parameter to retrieve sensitive files such as wp-config.php, which contains database credentials and security keys.

Compounding the risk, the vulnerable AJAX handler lacks proper capability checks. Although protected by a nonce, attackers with minimal access can obtain it and execute malicious shortcodes, enabling file extraction.

The second flaw, rated 7.5 (High), impacts versions up to 3.15.1 and allows unauthenticated attackers to perform time-based SQL injection attacks.

The vulnerability exists in the handling of the product_order parameter within a database query. While the input is sanitized, it is not properly parameterized using secure database methods. This oversight allows attackers to inject malicious SQL commands into queries.

Although traditional data-extraction methods such as UNION-based injection are not feasible, attackers can still exploit the flaw via time-based blind SQL injection. By leveraging SQL functions such as SLEEP(), they can gradually extract sensitive data, including password hashes.

Notably, this vulnerability only affects sites that previously used WooCommerce and later deactivated it, making it a conditional but still dangerous risk.

Wordfence quickly responded by releasing firewall protections. Premium users received mitigation for the file read issue on March 25, 2026, while free users were protected by April 24, 2026. SQL injection attempts are blocked by default through built-in firewall rules.

The Avada team released a partial fix in version 3.15.2 on April 13, followed by a complete patch in version 3.15.3 on May 12, 2026.

Website administrators are strongly urged to update to Avada Builder version 3.15.3 immediately. Delaying updates could leave sites exposed to data theft or full compromise.

For example, an attacker exploiting the file-read flaw could retrieve configuration files and then use stolen database credentials to take over the entire website.

With over a million installations affected, this incident highlights the ongoing risks posed by plugin vulnerabilities in the WordPress ecosystem and the importance of timely patching and layered security defenses.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.