CVE-2026-4782: Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusiongetsvgfromfile' function with the 'customsvg' parameter of the 'fusionsectionseparator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4782?
CVE-2026-4782 is classified as a high severity vulnerability due to the potential for arbitrary file read by authenticated users.
How do I fix CVE-2026-4782?
To fix CVE-2026-4782, users should update the Avada Builder plugin to the latest version beyond 3.15.2.
Who is affected by CVE-2026-4782?
CVE-2026-4782 affects any WordPress installation using Avada Builder versions up to and including 3.15.2.
What type of vulnerability is CVE-2026-4782?
CVE-2026-4782 is an Arbitrary File Read vulnerability that can be exploited via the 'custom_svg' shortcode parameter.
Can CVE-2026-4782 be exploited by unauthenticated users?
No, CVE-2026-4782 requires authentication as a Subscriber or higher to exploit the vulnerability.