EUVD-2026-29933Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
AnalysisAI
Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subscriber-level access to read arbitrary files on the server via the 'fusion_get_svg_from_file' function in the 'fusion_section_separator' shortcode. Sensitive information including configuration files, database credentials, and private keys can be exposed. The vulnerability was partially patched in 3.15.2 and fully patched in version 3.15.3.
Technical ContextAI
The Avada Builder plugin processes the 'custom_svg' parameter within the 'fusion_section_separator' shortcode through the 'fusion_get_svg_from_file' function. This function fails to properly validate or sanitize file path input, allowing path traversal attacks (CWE-36: Path Traversal). The vulnerability exists in the SVG file retrieval mechanism, which is accessible to authenticated users at the Subscriber level and above. The affected component is part of the theme fusion framework's shortcode processing system.
RemediationAI
Immediately upgrade Avada Builder to version 3.15.3 or later, which includes the complete patch. Site administrators should prioritize this update due to the low authentication barrier (Subscriber level). Prior to patching, apply compensating controls: restrict the 'fusion_section_separator' shortcode usage to trusted administrators only by removing Subscriber capability to publish content with this shortcode, and audit file system logs for evidence of unauthorized file access attempts via this function. If immediate patching is impossible, disable the 'fusion_section_separator' shortcode entirely or restrict it to Administrator-only content areas. See Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve for further guidance.
More in Avada Fusion Builder
View allArbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthentica
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the
Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and includin
Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive dat
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated c
Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated a
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated co
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attacke
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above t
Same weakness CWE-36 – Absolute Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today