Loading vulnerability…
Time-based SQL Injection in Avada Builder product_order Parameter
CVE-2026-4798 is a high-severity time-based blind SQL injection vulnerability in the Avada Builder plugin for WordPress. It affects versions up to and including 3.15.1. The flaw is caused by insufficient escaping of the user-controlled product_order parameter together with inadequate use of prepared statements in an existing SQL query. As a result, unauthenticated attackers can inject SQL syntax into backend database queries and use timing-based techniques to infer database contents without direct query output. The vulnerability is only reachable in environments where WooCommerce had previously been used and was later deactivated. Successful exploitation can expose sensitive information stored in the WordPress database, including credential material such as password hashes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated attackers to extract sensitive data from the site's database through blind, time-based SQL injection. Exposed information may include password hashes, user-related records, and other confidential application data stored in WordPress. Depending on the database contents and surrounding environment, this can enable follow-on actions such as credential cracking, account compromise, and broader compromise of the affected site.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or removing the vulnerable plugin functionality until an update can be applied. Because exploitation depends on a specific WooCommerce-related state, administrators should also review sites where WooCommerce was previously installed and later deactivated, and prioritize those systems for urgent remediation. Additional defensive measures such as database activity monitoring and a web application firewall may help detect or hinder exploitation attempts, but they are not substitutes for patching.
Patch, then assume compromise.
Upgrade Avada Builder to a fixed release. The available information indicates that version 3.15.2 addressed CVE-2026-4798, and later releases such as 3.15.3 also contain the fix. Administrators should update to the latest available Avada Builder version to ensure complete remediation and reduce exposure to other disclosed vulnerabilities in the product line.
No public exploits tracked yet. Mallory keeps watching.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.