Avada Builder CVE-2026-4782

Exploitation requires the following specific conditions: (1) A valid WordPress user account with Subscriber-level access or higher, (2) Ability to publish or edit content containing the 'fusion_section_separator' shortcode with the 'custom_svg' parameter, (3) Avada Builder plugin installed and activated on the target WordPress site, (4) Vulnerable version (3.15.2 or earlier). The vulnerability does not require administrator access, making it exploitable by lower-privileged accounts. Sites with strict user role management that prevents Subscribers from publishing shortcode-containing content, or sites that disable the Avada Builder plugin, are not affected.

CVSS 6.5 with network vector (AV:N/AC:L) indicates relatively easy exploitation over the network with low complexity. However, the vulnerability requires authentication (PR:L - Subscriber-level or higher), which limits the attack surface compared to unauthenticated network vulnerabilities. The lack of confidentiality impact is solely file read access; no integrity or availability impact exists. EPSS and KEV status are not provided in available data, but this is a confirmed arbitrary file read affecting a popular WordPress theme used by thousands of sites. The real-world risk depends on whether attackers can obtain valid Subscriber credentials through other means (e.g., brute force, leaked credentials, or lateral movement from compromised plugins). The partial patch in 3.15.2 and full patch in 3.15.3 indicate the vendor identified residual risk after the initial fix attempt.

An attacker with valid WordPress Subscriber credentials (obtained through credential stuffing, phishing, or leaked databases) logs into a targeted WordPress site using Avada Builder. The attacker then crafts a post or page containing a 'fusion_section_separator' shortcode with a malicious 'custom_svg' parameter pointing to '../../../etc/passwd' or similar paths. Upon page preview or publication, the 'fusion_get_svg_from_file' function reads the specified system file and the attacker extracts its contents from the rendered page or response.