# CVE-2026-4782: Avada Builder arbitrary file read in fusion_get_svg_from_file

Source: https://junglewise.ai/threats/cve-2026-4782-avada-builder-arbitrary-file-read-in-fusion-get-svg-from-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-4782 · Severity: medium · CVSS 6.5 · Published 2026-05-13

Avada Builder, a popular page-building tool for WordPress websites, contains a security flaw that allows logged-in users to view private files on the web server. Even users with low-level access, such as subscribers, could exploit this to steal sensitive configuration data or system information. This could lead to further attacks or the exposure of confidential site data.

Technologies: [ThemeFusion Avada Builder](https://junglewise.ai/threats/technologies/avada-builder). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-4782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4782 being exploited in the wild.

**How severe is CVE-2026-4782?** Medium severity, with a CVSS score of 6.5, published 13 May 2026.

**Which products and versions are affected?** ThemeFusion Avada Builder up to and including 3.15.2.

**Is there a fix for CVE-2026-4782?** A patch was published on 2026-05-13: Full patch released in version 3.15.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4782 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4782?** Check whether you run ThemeFusion Avada Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Avada Builder plugin for WordPress is vulnerable to an arbitrary file read vulnerability (path traversal) due to insufficient input validation in the 'fusion_get_svg_from_file' function. Specifically, the 'custom_svg' parameter within the 'fusion_section_separator' shortcode does not properly sanitize file paths. An authenticated attacker with Subscriber-level permissions or higher can exploit this to retrieve the contents of arbitrary files on the server, such as wp-config.php. The issue was partially addressed in version 3.15.2 and fully resolved in version 3.15.3.

## Affected products

- ThemeFusion Avada Builder up to and including 3.15.2

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched: Full patch released in version 3.15.3

## References

- [https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226](https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=cve)

## Related threats

- [ThemeFusion Avada Builder stored XSS in Module Title parameter](https://junglewise.ai/threats/cve-2026-12536-themefusion-avada-builder-stored-xss-in-module-title-parameter)
- [ThemeFusion Avada Builder arbitrary file deletion via path traversal](https://junglewise.ai/threats/cve-2026-8713-themefusion-avada-builder-arbitrary-file-deletion-via-path)
- [ThemeFusion Avada Builder RCE via PHP Function Injection](https://junglewise.ai/threats/cve-2026-6279-themefusion-avada-builder-rce-via-php-function-injection)
- [ThemeFusion Avada Builder Stored XSS in Shortcodes](https://junglewise.ai/threats/cve-2026-1543-themefusion-avada-builder-stored-xss-in-shortcodes)
- [ThemeFusion Avada Builder SQL injection in product_order parameter](https://junglewise.ai/threats/cve-2026-4798-themefusion-avada-builder-sql-injection-in-product-order-parameter)