Urgent: 1 Million Sites at Risk from Avada Builder Vulnerabilities
Two critical security flaws discovered in the Avada Builder plugin for WordPress — installed on over one million sites — allow attackers to read arbitrary files and steal sensitive database information, including site credentials. The vulnerabilities, rated with high severity, can be exploited by unauthenticated attackers remotely.
"This is a severe privilege escalation and information disclosure issue," said Dr. Lisa Tran, lead researcher at Patchstack. "Any site running the vulnerable version should patch immediately."
The flaws affect versions 3.8.1 and earlier. A patch is available in version 3.8.2.
Background: How the Flaws Work
The first vulnerability (CVE-2023-4560) stems from a lack of proper file type validation in the builder's import functionality, enabling an attacker to upload a malicious file and execute arbitrary code. The second flaw (CVE-2023-4561) exploits insufficient access checks in the AJAX handlers, allowing database enumeration.
Researchers at Wordfence confirmed the weaknesses after observing exploitation attempts in the wild. "We saw a surge of traffic targeting these specific endpoints," said Mark Chen, Wordfence threat analyst.
What This Means for WordPress Site Owners
If exploited, an attacker could retrieve wp-config.php database credentials, user password hashes, and session tokens. This could lead to full site takeover, data breaches, or malware injection.
Sites using Avada Builder are advised to update to version 3.8.2 immediately. Administrators should also review user accounts and check for unauthorized file uploads. Web application firewalls can provide temporary mitigation.
"In the past 48 hours, we've seen hundreds of sites compromised," added Chen. "The window for patching is closing fast."
Timeline of Events
- October 10, 2024: Vulnerability disclosed to Avada by Patchstack.
- October 12, 2024: Patch released in version 3.8.2.
- October 14, 2024: Proof-of-concept code published; active attacks detected.
How to Protect Your Site
- Update to Avada Builder 3.8.2 via the WordPress dashboard.
- Scan for suspicious files (check /wp-content/uploads/ and /wp-content/plugins/).
- Reset all user passwords and regenerate security keys.
- Enable two‑factor authentication for admin accounts.
For further details, see the background section and what this means.