Avada Builder WordPress plugin flaws allow site credential theft

**Avada Builder vulnerabilities (CVE-2026-4782 & CVE-2026-4798):** Two serious flaws in the Avada Builder WordPress plugin—an authenticated arbitrary file read allowing access to sensitive files like wp-config.php, and a time-based blind SQL injection exploitable under specific WooCommerce conditions—affect roughly one million active installs; partial and full fixes were released (3.15.2 and 3.15.3) and site owners are advised to upgrade to 3.15.3 immediately.