The Avada Builder plugin for WordPress contains a time‑based SQL injection vulnerability in the product_order parameter in all releases through 3.15.1. The parameter is not properly escaped and the surrounding query is not prepared, allowing an attacker to append and execute arbitrary SQL statements. This can lead to extraction of sensitive database contents by unauthenticated users.

The flaw exists in the themefusion Avada Builder plugin for WordPress, affecting all versions up to and including 3.15.1. An external attacker only needs a site that had WooCommerce installed in the past and subsequently deactivated; the presence of WooCommerce during the exploitation sequence is required only historically.

With a CVSS score of 7.5 the vulnerability is considered moderate‑to‑high severity. The EPSS score is unavailable, and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploitation yet. The attack vector is purely HTTP, exploiting an unauthenticated request that includes a crafted product_order value. Because the vulnerability requires a specific historical configuration of WooCommerce, the risk to typical installations is limited but still significant enough to warrant remediation.