Avada Builder turns low-privilege access into a server-side secret leak. A subscriber-level account can read wp-config.php, which means database credentials and salts can fall out of a single plugin bug instead of a full admin compromise.
Wordfence says the two flaws affect about one million WordPress sites. CVE-2026-4782 is an arbitrary file read, and CVE-2026-4798 is an unauthenticated SQL injection on sites that had WooCommerce installed and later deactivated; the fixed release is 3.15.3, with 3.15.2 only partially addressing the issue.
The real danger is second-order exposure. If wp-config.php was readable, the compromise can outlast the patch because stolen credentials and keys may still open the database or other systems that reused them.