CVE-2026-4782

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.

• CWE-36

• https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
• https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47782Android App "RoboForm Password Manager" provided by Siber Sy…4.6
• CVE-2026-47783In memcached before 1.6.42, username data for SASL password …8.1
• CVE-2026-47784In memcached before 1.6.42, password data for SASL password …8.1
• CVE-2026-4779A security vulnerability has been detected in SourceCodester…8.8
• CVE-2026-4780A vulnerability was detected in SourceCodester Sales and Inv…8.8
• CVE-2026-4781A flaw has been found in SourceCodester Sales and Inventory …8.8
• CVE-2026-47825Spring Cloud Gateway Server forwards the X-Forwarded-For and…8.6
• CVE-2026-47826The blobs.yml path key traversal vulnerability in the BOSH C…9.1
• CVE-2026-47828During bosh create-env and bosh delete-env, the CLI uploads …8.8
• CVE-2026-47829Argument Injection in bosh-cli allows a compromised BOSH Dir…7.8
• CVE-2026-4783A vulnerability has been found in itsourcecode College Manag…6.3
• CVE-2026-47830Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-E…8.8