CVE-2026-4782mediumCWE-36

CVE-2026-4782: medium-severity vulnerability in themefusion Avada (Fusion) Builder

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

Published

Follow this CVE+ Monitor Avada Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.5%
from disclosure to weapon37 days
Published on NVDMay 13
1st PoC+37d
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
themefusion · Avada (Fusion) Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — themefusion Avada (Fusion) Builder

In the same product, most dangerous first.

CVE-2026-6279CRITICALAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX HandlerEPSS 9.9%CVE-2026-8713CRITICALAvada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry ValueEPSS 3.0%CVE-2026-18431CRITICALAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 0.9%CVE-2024-13345HIGHAvada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2026-4798HIGHAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' ParameterEPSS 0.5%CVE-2026-97670CRITICALAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form FieldEPSS 0.5%