Home / Technology / Avada Builder Flaws Exposed: Millions at Risk
Avada Builder Flaws Exposed: Millions at Risk
14 May
Summary
- Two flaws found in Avada Builder, a WordPress plugin.
- Vulnerabilities could allow data exfiltration and password theft.
- Updates are available; users urged to install version 3.15.3+.
Wordfence has disclosed two significant security flaws affecting the Avada Builder plugin, a popular WordPress tool used by over a million active websites. These vulnerabilities, identified as CVE-2026-4782 (Arbitrary File Read, medium severity) and CVE-2026-4798 (SQL injection, high severity), could enable attackers to access sensitive information or extract database contents.
The Arbitrary File Read vulnerability requires subscriber-level access to exploit, while the SQL injection flaw can be leveraged by unauthenticated attackers. Developers released patches for these issues on April 13 and May 12, 2026. Users are strongly encouraged to update their Avada Builder plugin to version 3.15.3 or a later version to mitigate these risks.
Researcher Rafie Muhammad was credited with discovering and responsibly reporting these vulnerabilities through the Wordfence Bug Bounty Program, receiving approximately $4,500 for his efforts. Wordfence highlighted its commitment to enhancing WordPress security through vulnerability research and collaboration.
