What is the CVSS score of CVE-2026-4782?

CVE-2026-4782 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Avada Builder CVE-2026-4782

EUVD-2026-29933 MEDIUM

Absolute Path Traversal (CWE-36)

2026-05-13 Wordfence

RCE WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 10:30 vuln.today

CVE Published

May 13, 2026 - 09:26 nvd

MEDIUM 6.5

DescriptionCVE.org

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.

AnalysisAI

Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subscriber-level access to read arbitrary files on the server via the 'fusion_get_svg_from_file' function in the 'fusion_section_separator' shortcode. Sensitive information including configuration files, database credentials, and private keys can be exposed. The vulnerability was partially patched in 3.15.2 and fully patched in version 3.15.3.

Technical ContextAI

The Avada Builder plugin processes the 'custom_svg' parameter within the 'fusion_section_separator' shortcode through the 'fusion_get_svg_from_file' function. This function fails to properly validate or sanitize file path input, allowing path traversal attacks (CWE-36: Path Traversal). The vulnerability exists in the SVG file retrieval mechanism, which is accessible to authenticated users at the Subscriber level and above. The affected component is part of the theme fusion framework's shortcode processing system.

RemediationAI

Immediately upgrade Avada Builder to version 3.15.3 or later, which includes the complete patch. Site administrators should prioritize this update due to the low authentication barrier (Subscriber level). Prior to patching, apply compensating controls: restrict the 'fusion_section_separator' shortcode usage to trusted administrators only by removing Subscriber capability to publish content with this shortcode, and audit file system logs for evidence of unauthorized file access attempts via this function. If immediate patching is impossible, disable the 'fusion_section_separator' shortcode entirely or restrict it to Administrator-only content areas. See Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve for further guidance.