What is the CVSS score of CVE-2026-4798?

CVE-2026-4798 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Avada Builder are affected by CVE-2026-4798?

Avada Builder for WordPress contains a time-based SQL injection vulnerability (CVE-2026-4798) that permits unauthenticated attackers to extract sensitive database information from affected sites.

How to fix or mitigate CVE-2026-4798?

Within 24 hours: Identify all WordPress installations using Avada Builder and audit WooCommerce installation history via admin plugins panel; document affected sites. Within 7 days: Apply input validation controls via Web Application Firewall (WAF) rules blocking requests with SQL metacharacters in 'product_order' parameter; consider disabling Avada Builder features accepting this parameter if not operationally critical. Within 30 days: Monitor Avada/Themeforest vendor advisories for patch release; conduct database access audit to identify any unauthorized queries executed against sensitive tables.

Avada Builder CVE-2026-4798

EUVD-2026-29934 HIGH

SQL Injection (CWE-89)

2026-05-13 Wordfence

SQLi WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 10:30 vuln.today

CVE Published

May 13, 2026 - 09:26 nvd

HIGH 7.5

DescriptionCVE.org

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated.

AnalysisAI

Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive database information via the 'product_order' parameter. CVSS 7.5 (High) reflects network-accessible attack vector with no authentication required, but exploitation is limited to specific deployments where WooCommerce was previously installed then deactivated. No active exploitation confirmed (not in CISA KEV), but vulnerability disclosed by Wordfence Threat Intelligence with technical details publicly available.

Technical ContextAI

Avada Builder (Fusion Builder component, CPE: cpe:2.3:a:themefusion:avada_(fusion)_builder) is a premium WordPress page builder plugin. This vulnerability stems from CWE-89 (SQL Injection) where user-supplied input to the 'product_order' parameter lacks proper escaping and prepared statement handling. Time-based SQL injection techniques allow attackers to infer database contents by measuring response delays when injecting conditional SQL statements with time-delay functions (e.g., SLEEP(), BENCHMARK()). The attack surface exists only in environments with residual WooCommerce database schema after plugin deactivation, suggesting the vulnerable code path queries WooCommerce product tables that persist post-uninstallation. WordPress plugins commonly fail to sanitize parameters when interfacing with optional dependencies like WooCommerce, creating SQL injection risks in cross-plugin data handling.

RemediationAI

Upgrade Avada Builder to version 3.15.2 or later if available (verify with ThemeFusion vendor at https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 or via theme update mechanism in WordPress admin). Consult Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=cve) for specific patch version confirmation. If patched version is not yet released or immediate upgrade is not feasible, implement these compensating controls: (1) Deploy web application firewall (WAF) rules to block SQL injection patterns in 'product_order' parameter - affects sorting functionality but prevents exploitation; (2) Remove residual WooCommerce database tables if WooCommerce is permanently deactivated using plugins like WP Reset or manual SQL cleanup - eliminates attack surface but irreversibly deletes historical e-commerce data; (3) Restrict WordPress admin and AJAX endpoints to authenticated users via .htaccess or server config - may break legitimate unauthenticated AJAX calls depending on theme functionality. Monitor database query logs for anomalous SLEEP() or time-delay function execution. Trade-offs: WAF rules may cause false positives on legitimate product sorting; table deletion prevents future WooCommerce reactivation without data migration; authentication restrictions require thorough testing of front-end features.