EUVD-2026-29934Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated.
AnalysisAI
Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive database information via the 'product_order' parameter. CVSS 7.5 (High) reflects network-accessible attack vector with no authentication required, but exploitation is limited to specific deployments where WooCommerce was previously installed then deactivated. No active exploitation confirmed (not in CISA KEV), but vulnerability disclosed by Wordfence Threat Intelligence with technical details publicly available.
Technical ContextAI
Avada Builder (Fusion Builder component, CPE: cpe:2.3:a:themefusion:avada_(fusion)_builder) is a premium WordPress page builder plugin. This vulnerability stems from CWE-89 (SQL Injection) where user-supplied input to the 'product_order' parameter lacks proper escaping and prepared statement handling. Time-based SQL injection techniques allow attackers to infer database contents by measuring response delays when injecting conditional SQL statements with time-delay functions (e.g., SLEEP(), BENCHMARK()). The attack surface exists only in environments with residual WooCommerce database schema after plugin deactivation, suggesting the vulnerable code path queries WooCommerce product tables that persist post-uninstallation. WordPress plugins commonly fail to sanitize parameters when interfacing with optional dependencies like WooCommerce, creating SQL injection risks in cross-plugin data handling.
RemediationAI
Upgrade Avada Builder to version 3.15.2 or later if available (verify with ThemeFusion vendor at https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 or via theme update mechanism in WordPress admin). Consult Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=cve) for specific patch version confirmation. If patched version is not yet released or immediate upgrade is not feasible, implement these compensating controls: (1) Deploy web application firewall (WAF) rules to block SQL injection patterns in 'product_order' parameter - affects sorting functionality but prevents exploitation; (2) Remove residual WooCommerce database tables if WooCommerce is permanently deactivated using plugins like WP Reset or manual SQL cleanup - eliminates attack surface but irreversibly deletes historical e-commerce data; (3) Restrict WordPress admin and AJAX endpoints to authenticated users via .htaccess or server config - may break legitimate unauthenticated AJAX calls depending on theme functionality. Monitor database query logs for anomalous SLEEP() or time-delay function execution. Trade-offs: WAF rules may cause false positives on legitimate product sorting; table deletion prevents future WooCommerce reactivation without data migration; authentication restrictions require thorough testing of front-end features.
More in Avada Fusion Builder
View allArbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthentica
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the
Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and includin
Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subs
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated c
Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated a
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated co
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attacke
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above t
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today