Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files and extract sensitive information from the database.

BleepingComputer

Two security vulnerabilities have been discovered in the Avada Builder WordPress plugin, which has approximately one million active installations. CVE-2026-4782 is an arbitrary file read flaw exploitable by authenticated users with subscriber-level access, allowing them to read sensitive files like wp-config.php containing database credentials. CVE-2026-4798 is an unauthenticated time-based blind SQL injection affecting sites that previously used WooCommerce, enabling extraction of password hashes from the database. Both were reported via the Wordfence Bug Bounty Program. A full patch is available in version 3.15.3, released May 12, and site owners are urged to update immediately.

Avada Builder WordPress plugin flaws allow site credential theft

This kind of news hits differently when you manage a lot of WordPress client sites using the same stack.
We use Avada Builder across quite a few projects, so the worrying part here is not just the vulnerability itself, it’s the scale. The moment a widely used plugin gets exposed, it becomes a huge attack surface overnight.
What people also underestimate is the operational side of this. Suddenly you’re auditing installs, checking versions, testing updates, reviewing backups, and making sure client sites are not exposed. Across multiple sites, that becomes messy very quickly.
At the same time, this is not just an “Avada problem.” Any large plugin ecosystem will eventually run into security issues. The real difference is how quickly patches are released and how seriously agencies and developers handle updates afterward.
If you manage WordPress sites professionally and still do not have proper update routines, backups, and monitoring in place, you are honestly taking a huge risk.