Avada Builder, a widely used WordPress plugin with around 1 million active installations, has been patched after a critical vulnerability was discovered. This flaw allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to severe security breaches, including remote code execution. Site owners should update to the latest version immediately to mitigate risks.
Details of the Vulnerability
The vulnerability affects all versions of Avada Builder up to 3.15.3. It enables attackers to exploit the plugin’s form submission feature to delete critical files, such as wp-config.php, from the server. This could result in a complete site takeover, as the deletion of wp-config.php can reset the WordPress installation, allowing attackers to gain control over the site.
Avada Team’s Response
Upon receiving the report on May 13, 2026, the Avada team acknowledged the issue and released a patch (version 3.15.4) on June 2, 2026. The quick response is commendable, but site owners must act fast to ensure their installations are updated to the patched version to avoid exploitation.
Recommendations for Users
Site owners using Avada Builder should update to version 3.15.4 without delay. Not updating could expose your site to unauthorized file deletions and potential takeovers. Regularly check for updates and ensure your plugins are secure to protect your website from vulnerabilities.
Frequently Asked Questions
What versions of Avada Builder are affected by the vulnerability?
All versions up to and including 3.15.3 are affected.
What is the patched version of Avada Builder?
The patched version is 3.15.4, released on June 2, 2026.
How can the vulnerability be exploited?
Attackers can exploit the vulnerability to delete critical files like wp-config.php, leading to site compromise.
What should I do if I use Avada Builder?
You should update to the latest version (3.15.4) immediately to protect your site.