The Avada Builder plugin for WordPress has a flaw that allows authenticated users with Subscriber level access or higher to read any file on the server. The vulnerability is triggered by the "custom_svg" parameter of the "fusion_section_separator" shortcode via the internal function "fusion_get_svg_from_file". If an attacker can supply a path, the plugin will return the file contents, exposing potentially sensitive data such as configuration files, credentials, or user data. The weakness is a classic path traversal scenario, matching CWE‑36.

WordPress sites that have the Avada (Fusion) Builder plugin from ThemeFusion installed, with version 3.15.2 or earlier. All installations employing this plugin and its shortcodes are susceptible; upgrades to version 3.15.3 or later remove the flaw.

The CVSS score of 6.5 indicates a moderate severity due to confidentiality impact and the requirement for authentication. The EPSS score is not available, and the vulnerability is not in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet. However, since the attack vector requires an authenticated session, any compromised or brute‑forced WordPress credentials elevate risk. An attacker could read arbitrary files, potentially gaining credentials or system information, which could facilitate further lateral movement or code execution if sensitive files are exposed.