Vulnerability intelligence

CVE-2026-4782

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.

CVSS Score

6.5

Medium

EPSS — Exploit Probability

0.5%

Riskier than 38% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered May 13, 2026 · latest May 13, 2026

Coverage timeline

Avada Builder Flaws Expose One Million WordPress Sites
www.infosecurity-magazine.com · May 13, 2026