Critical Vulnerabilities in Avada Builder Plugin Expose 1 Million WordPress Sites to Attacks On May 13, 2026, cybersecurity firm Wordfence disclosed two severe vulnerabilities in the Avada Builder WordPress plugin, a page builder bundled with the popular Avada theme by ThemeFusion. The flaws, discovered by researcher Rafie Muhammad and reported via Wordfence’s Bug Bounty Program, earned a combined bounty of $4,453. Approximately 1 million active websites are at risk of credential theft, database compromise, and full-site takeover. The most critical flaw, CVE-2026-4798 (CVSS 7.5), is an unauthenticated SQL injection vulnerability affecting all versions of Avada Builder up to 3.15.1. The issue stems from improper sanitization of the `product_order` GET parameter in the plugin’s `post_query()` function, allowing attackers to execute time-based blind SQL injection attacks. Exploitation requires WooCommerce to have been previously installed and deactivated, leaving residual database tables. Successful attacks could extract password hashes and sensitive data by measuring server response delays. The second vulnerability, CVE-2026-4782 (CVSS 6.5), enables arbitrary file read via the `fusion_get_svg_from_file()` function, triggered by the `custom_svg` parameter in the `fusion_section_separator` shortcode. Due to missing file validation and insufficient access controls, authenticated users with Subscriber-level access can read any server file, including wp-config.php, which contains database credentials and cryptographic salts. Attackers could forge admin sessions, create rogue accounts, and deploy backdoors. Wordfence reported the vulnerabilities to ThemeFusion on March 24–25, 2026. A partial patch (3.15.2) addressing the SQL injection flaw was released on April 13, 2026, with the complete fix (3.15.3) arriving on May 12, 2026. Wordfence Premium, Care, and Response users received firewall protection on March 25, 2026, while free users gained coverage 30 days later. Security analysts highlight that Avada Builder’s theme-bundled architecture complicates updates, as users cannot patch the plugin independently of the theme. Administrators are urged to upgrade to version 3.15.3 immediately and audit for unauthorized access or modified files.