Vulnerability · Published May 13, 2026 · Assigned by Wordfence
CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Medium 6.5
In plain English
A medium-severity security flaw in Avada (Fusion) Builder from themefusion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| themefusion | Avada (Fusion) Builder | 0 – through 3.15.2 |
Weakness: CWE-36 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N