Back Scworld

Two vulnerabilities found in popular WordPress plugin Avada Builder | brief

Scworld • May 14, 2026

Based on information from Tech Radar, two security flaws were discovered in Avada Builder, a widely used WordPress plugin with approximately one million active installations. These vulnerabilities could have potentially allowed unauthorized access to sensitive user data.

Patches for these issues were released by the developers in April and May 2026, with users strongly advised to update to version 3.15.3 or later. The researcher who discovered these flaws, Rafie Muhammad, was awarded a bounty of around $4,500 through the Wordfence Bug Bounty Program.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Avada Builder Plugin Expose WordPress Sites to Credential Theft Two vulnerabilities in the Avada Builder plugin for WordPress, affecting approximately one million installations, allow unauthorized access to sensitive data. The first vulnerability enables hackers to read arbitrary files, including wp-config.php, which contains critical database credentials. The second, an SQL injection flaw (CVE-2026-4798), can be exploited by unauthenticated attackers to extract sensitive information from the database, provided the WooCommerce plugin was previously used. These issues were reported by researcher Rafie Muhammad, who received a total bounty of $4,453. A partial fix was released on April 13, 2026, and a complete patch on May 12, 2026. Website administrators are urged to update to version 3.15.3 immediately to mitigate these risks. 4 sources 72

Two vulnerabilities found in popular WordPress plugin Avada Builder | brief

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (2)