Avada Builder Flaws Expose 1 Million WordPress Sites to File Read and SQL Injection

Two vulnerabilities in the widely used Avada Builder WordPress plugin exposed more than 1 million sites to data theft risks, including an unauthenticated SQL injection flaw tracked as CVE-2026-4798 and an authenticated arbitrary file read flaw tracked as CVE-2026-4782. Security researchers said the SQL injection issue could allow attackers to extract sensitive database contents, including credentials and password hashes, while the file read bug could let low-privileged users access sensitive files such as wp-config.php.

The flaws were discovered by researcher Rafie Muhammad through the Wordfence Bug Bounty Program, and the vendor addressed the issues in Avada Builder 3.15.3. Reports said the vulnerabilities affected versions up to 3.15.2 and 3.15.1 respectively, with the SQL injection issue requiring a specific WooCommerce-related condition for exploitation. Administrators were urged to update immediately, review subscriber and other low-privilege accounts, and monitor for suspicious file access and unusual database activity on unpatched sites.