Loading vulnerability…
Arbitrary File Read in Avada Builder WordPress Plugin
CVE-2026-4782 is an authenticated arbitrary file read vulnerability in the Avada Builder plugin for WordPress, also known as fusion-builder. It affects all versions up to and including 3.15.2. The flaw is present in the handling of the fusion_section_separator shortcode, specifically when the custom_svg parameter is processed by the fusion_get_svg_from_file function without sufficient validation of the supplied file path. An attacker with Subscriber-level access or higher can abuse this behavior to cause the plugin to read arbitrary files from the server filesystem and return their contents. The issue was only partially addressed in version 3.15.2 and fully fixed in version 3.15.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged authenticated attacker to read arbitrary files accessible to the web server account. This can expose sensitive application and system data, including WordPress configuration files, database credentials, authentication material, security keys, and other locally stored secrets. The vulnerability primarily enables confidentiality compromise and can facilitate follow-on attacks such as database access, account compromise, and broader site takeover when exposed secrets are reused or sufficient for further intrusion.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure by restricting or removing low-privilege accounts such as unnecessary Subscriber users, limiting who can invoke affected shortcode functionality, and disabling the Avada Builder plugin if operationally feasible. Review access controls around content creation and shortcode use, and monitor for suspicious attempts to access sensitive local files through plugin functionality.
Patch, then assume compromise.
Upgrade Avada Builder to version 3.15.3 or later. Version 3.15.2 only partially addressed the issue and should not be considered a complete fix for CVE-2026-4782. If Avada Builder is bundled through the Avada theme, ensure the bundled component is updated to a release that includes Avada Builder 3.15.3 or newer.
1 exploit validated by Mallory's analysis.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.