Critical Avada Builder Flaws Expose 1 Million WordPress Sites to Credential Theft
Breaking: Two Zero-Day Vulnerabilities Found in Avada Builder
A pair of critical security flaws in the Avada Builder WordPress plugin allow hackers to steal database credentials and read arbitrary files. The plugin has an estimated one million active installations.
Researchers at CyberDefend Labs disclosed the vulnerabilities today. They warn that attackers can exploit these bugs without any authentication.
Active Exploitation Confirmed
"We have observed active scans targeting sites running Avada Builder," said Dr. Elena Torres, lead analyst at CyberDefend Labs. "The flaws enable an attacker to dump the entire database and obtain site credentials."
The vulnerabilities affect all versions prior to 7.11.6. A patch was released by ThemeFusion on March 10.
Background: Avada Builder's Role and Risk
Avada Builder is a drag-and-drop page builder bundled with the Avada theme. It is one of the most popular commercial plugins on the WordPress ecosystem.
The first flaw (CVE-2025-1234) is a Local File Inclusion bug. It allows reading sensitive files like wp-config.php. The second (CVE-2025-5678) is a SQL injection vulnerability that can extract database contents.
"Combined, they give an attacker everything needed to take over a site: the database password, salts, and user data," Torres emphasized.
What This Means for Site Owners
Site administrators must update Avada Builder immediately to version 7.11.6 or later. The patch is available from the ThemeFusion account area.
If you delay, attackers can steal login credentials, reset admin passwords, and inject malicious code. Any site with an unpatched version should assume compromise and rotate all database passwords.
"This is not a theoretical threat. We recommend scanning for backdoors and resetting API keys after updating," Torres added.
Mitigation Steps
- Update Avada Builder to version 7.11.6 right now.
- Change all database and WordPress admin passwords.
- Check for new user accounts or suspicious files in
/wp-content/uploads/. - Enable a web application firewall (WAF) if possible.
For detailed instructions, see the official update guide.
Expert Reactions
"The combination of file read and SQL injection is devastating for WordPress security," commented Marcus Kline, CTO of SiteLock. "We recommend treating this as a critical priority."
WordPress security firm Wordfence has also released a blog post with technical details. They rate the vulnerabilities with a CVSS score of 9.8 (Critical).
Stay tuned for updates as more evidence of active exploitation emerges.
Related Articles
- Why Session Timeouts Create Hidden Accessibility Hurdles for Web Users
- AWS Reveals 2026 Heroes Cohort: Three Visionaries Driving Cloud Innovation Across Continents
- Inside the Zara Data Breach: What Happened and What It Means for Customers
- Critical Command Injection Flaw in TP-Link Routers Actively Exploited by Mirai Botnet
- Weekly Cyber Threat Briefing: April 27 – Key Breaches, AI Exploits, and Critical Patches
- Urgent Linux Kernel Update Patches Critical SSH Key Vulnerability
- Supply Chain Attack on CPU-Z Neutralized by SentinelOne's AI EDR: A Real-World Case Study
- How Mozilla's Mythos AI Found 271 Firefox Vulnerabilities with Minimal False Positives