CVE-2026-4782
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.47%
- CWE
- CWE-36
- Published
- 2026-05-13
- Last modified
- 2026-05-13
Affected products
- themefusion Avada (Fusion) Builder
Weakness type
Related vulnerabilities
- CVE-2026-68896 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-69612 — Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-47630 — NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an...
- CVE-2026-47606 — NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an...
- CVE-2026-46345 — compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
- CVE-2026-47243 — Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
- CVE-2026-54202 — TeamDavid: Path Traversal in the archive creation functionality
- CVE-2026-61891 — In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP...