WordPress · Avada Builder · CVE-2026-4782
**Name of the Vulnerable Software and Affected Versions**
Avada Builder versions prior to 3.15.3
**Description**
An arbitrary file read issue exists in the Avada Builder plugin for WordPress. Authenticated attackers with Subscriber-level access or higher can read arbitrary files on the server, potentially exposing sensitive information. This is possible through the `fusion get svg from file()` function using the `custom svg` parameter within the 'fusion section separator' shortcode.
**Recommendations**
Update to version 3.15.3.
As a temporary workaround, restrict access to the `fusion get svg from file()` function or the `custom svg` parameter in the 'fusion section separator' shortcode.