The Avada (Fusion) Builder WordPress plugin contains an absolute path traversal vulnerability (CWE-36) identified as CVE-2026-4782. This vulnerability exists in the 'fusion_get_svg_from_file' function, which processes the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. Authenticated users with at least Subscriber privileges can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive data. Versions up to and including 3.15.2 are affected, with partial remediation in 3.15.2 and a full fix implemented in 3.15.3. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to read arbitrary files on the server hosting the WordPress site. This can lead to exposure of sensitive information such as configuration files, credentials, or other data stored on the server. There is no indication of impact on integrity or availability. No known exploits are currently reported in the wild.

Upgrade the Avada Builder plugin to version 3.15.3 or later, which fully patches this vulnerability. Versions 3.15.2 include a partial fix but do not fully resolve the issue. Since this is a plugin vulnerability, site administrators should apply the update promptly to mitigate risk. Patch status is confirmed by the vendor's versioning information in the description.