18/05/2026
On March 21st, 2026, an Arbitrary File Read and an SQL Injection in Avada Builder, a plugin with an estimated 1,000,000 active installations. The arbitrary file read vulnerability can be used by authenticated , with subscriber-level access and above, to read arbitrary files on the , which may contain information.
- Read The Full Post Here:
On March 21st, 2026, we received a submission for an Arbitrary File Read and an SQL Injection vulnerability in Avada Builder, a WordPress plugin with an estimated 1,000,000 active installations.