Vulnerability

CERT-In Vulnerability Note CIVN-2026-0247
Multiple Vulnerabilities in Avada Builder WordPress Plugin

Original Issue Date:May 19, 2026

Severity Rating: HIGH

Software Affected

Avada Builder WordPress Plugin versions prior to 3.15.3.

Overview

Multiple vulnerabilities have been reported in Avada Builder WordPress Plugin which could allow an attacker to read arbitrary files, perform SQL Injection attacks, disclose sensitive information, and compromise the affected website.

Target Audience:
All organizations and individuals using affected Avada Builder WordPress Plugin installations.

Risk Assessment:
High risk due to the potential for arbitrary file read, SQL Injection, disclosure of sensitive information, and compromise of affected WordPress websites.

Impact Assessment:
Potential for arbitrary file read, SQL Injection, disclosure of sensitive information including credentials and password hashes, unauthorized database access, and compromise of affected systems.

Description

Multiple vulnerabilities exist in Avada Builder WordPress Plugin due to improper validation of user supplied input and insufficient sanitization of SQL queries.

An attacker could exploit these vulnerabilities remotely depending on the attack vector. In certain cases, exploitation may require authenticated access with Subscriber-level privileges, while in other scenarios exploitation may occur without authentication.

Successful exploitation of these vulnerabilities could allow an attacker to read arbitrary files, perform SQL Injection attacks, disclose sensitive information including credentials and password hashes, access backend database contents, and compromise the affected website.

Solution

Apply appropriate updates as mentioned by the Vendor:
https://www.wordfence.com/blog/2026/05/1000000-wordpress-sites-affected-by-arbitrary-file-read-and-sql-injection-vulnerabilities-in-avada-builder-wordpress-plugin/

Vendor Information

ThemeFusion
https://avada.com/

References

https://avada.com/
https://www.wordfence.com/blog/2026/05/1000000-wordpress-sites-affected-by-arbitrary-file-read-and-sql-injection-vulnerabilities-in-avada-builder-wordpress-plugin/

CVE Name
CVE-2026-4782
CVE-2026-4798

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India