PT-2026-40583 · WordPress · Avada Builder

Rafie Muhammad · CVE-2026-4782 · Published 2026-05-13 · Updated 2026-05-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avada Builder versions prior to 3.15.3

Description An arbitrary file read issue exists in the Avada Builder plugin for WordPress. Authenticated attackers with Subscriber-level access or higher can read arbitrary files on the server, potentially exposing sensitive information. This is possible through the fusion get svg from file() function using the custom svg parameter within the 'fusion section separator' shortcode.

Recommendations Update to version 3.15.3. As a temporary workaround, restrict access to the fusion get svg from file() function or the custom svg parameter in the 'fusion section separator' shortcode.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2026-4782

Affected Products

Avada Builder

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-4782 · Security Note
• https://twitter.com/DFIR_Radar/status/2054397326446481686 · Twitter Post
• https://i.redd.it/a2hencyj3z0h1.png · Reddit Post
• https://t.me/CVEtracker/53643 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054642722560966749 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve · Note
• https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 · Note
• https://twitter.com/aviatrixtrc/status/2055438631565738252 · Twitter Post
• https://twitter.com/jnrmanagement/status/2056358671765094513 · Twitter Post
• https://twitter.com/cybernewslive/status/2055428862754820138 · Twitter Post
• https://reddit.com/r/managedwphost/comments/1tf5weu/critical_vulnerabilities_found_in_avada_builder · Reddit Post