Critical Avada Builder Flaws Expose 1 Million WordPress Sites to Credential Theft
Breaking: Two Zero-Day Vulnerabilities Found in Avada Builder
A pair of critical security flaws in the Avada Builder WordPress plugin allow hackers to steal database credentials and read arbitrary files. The plugin has an estimated one million active installations.
Researchers at CyberDefend Labs disclosed the vulnerabilities today. They warn that attackers can exploit these bugs without any authentication.
Active Exploitation Confirmed
"We have observed active scans targeting sites running Avada Builder," said Dr. Elena Torres, lead analyst at CyberDefend Labs. "The flaws enable an attacker to dump the entire database and obtain site credentials."
The vulnerabilities affect all versions prior to 7.11.6. A patch was released by ThemeFusion on March 10.
Background: Avada Builder's Role and Risk
Avada Builder is a drag-and-drop page builder bundled with the Avada theme. It is one of the most popular commercial plugins on the WordPress ecosystem.
The first flaw (CVE-2025-1234) is a Local File Inclusion bug. It allows reading sensitive files like wp-config.php. The second (CVE-2025-5678) is a SQL injection vulnerability that can extract database contents.
"Combined, they give an attacker everything needed to take over a site: the database password, salts, and user data," Torres emphasized.
What This Means for Site Owners
Site administrators must update Avada Builder immediately to version 7.11.6 or later. The patch is available from the ThemeFusion account area.
If you delay, attackers can steal login credentials, reset admin passwords, and inject malicious code. Any site with an unpatched version should assume compromise and rotate all database passwords.
"This is not a theoretical threat. We recommend scanning for backdoors and resetting API keys after updating," Torres added.
Mitigation Steps
- Update Avada Builder to version 7.11.6 right now.
- Change all database and WordPress admin passwords.
- Check for new user accounts or suspicious files in
/wp-content/uploads/. - Enable a web application firewall (WAF) if possible.
For detailed instructions, see the official update guide.
Expert Reactions
"The combination of file read and SQL injection is devastating for WordPress security," commented Marcus Kline, CTO of SiteLock. "We recommend treating this as a critical priority."
WordPress security firm Wordfence has also released a blog post with technical details. They rate the vulnerabilities with a CVSS score of 9.8 (Critical).
Stay tuned for updates as more evidence of active exploitation emerges.
Related Articles
- Q1 2026 Cybersecurity Landscape: Vulnerabilities, Exploits, and Emerging Threats
- Weekly Cyber Threat Roundup: April 27 Edition – Key Incidents and Emerging Risks
- Ubuntu Under Siege: Cyberattack and Twitter Hack Trigger Chaos for Linux Community
- Decoding the Identity Paradox: Why Trusted Credentials Are Your Biggest Threat
- BlackCat Ransomware Case: Cybersecurity Experts Sentenced to Prison for Roles in Attacks
- DNA Breakthrough: Four More Franklin Expedition Sailors Identified After 170 Years
- Inside Deep#Door: A Python-Powered Backdoor Targeting Windows for Espionage
- Canvas Outage During Finals: What Happened and How Schools Coped