Atomic Edge analysis of CVE-2026-4798 (metadata-based): This vulnerability is an unauthenticated SQL injection in the Avada Builder plugin (fusion-builder) for WordPress, affecting versions up to and including 3.15.1. The injection occurs through the ‘product_order’ parameter and has a CVSS score of 7.5 (High) with confidentiality impact, no impact on integrity or availability.
The root cause, inferred from the CWE-89 classification and the description, is improper neutralization of special elements in the ‘product_order’ parameter before it is used in an SQL query. The plugin’s code likely reads this user-supplied parameter and directly concatenates it into a SQL query without sufficient escaping or parameterized preparation (prepared statements using $wpdb->prepare). The note that the vulnerability is exploitable only if WooCommerce was previously used (then deactivated) strongly suggests the vulnerable code resides in a shortcode or widget that renders WooCommerce-related output, possibly a product loop or filter shortcode that remains active even after WooCommerce is disabled. Because the vulnerable and patched plugin versions are not available from WordPress.org for code diffing, Atomic Edge analysis cannot confirm these specifics from source code; all root cause descriptions are based on the CWE and the provided description.
Exploitation is possible over the network (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N). No user interaction is needed (UI:N). An attacker would craft a crafted HTTP request to a WordPress page that loads a shortcode or element from the Avada Builder which processes the ‘product_order’ parameter. For example, the vulnerable endpoint might be a page with the Ajax_load_more or product_grid shortcode that uses the ‘product_order’ parameter to sort products. An attacker could send a request like: GET /wp-admin/admin-ajax.php?action=fusion_builder_ajax_load_products&product_order=1 AND (SELECT SLEEP(5)) — – or a similar time-based blind SQL injection payload via POST or GET parameters. Since the description mentions time-based SQL injection, the attacker would use conditional timing delays to infer database contents character by character.
The remediation involves updating to version 3.15.2, which contains the fix. The code change likely includes using parameterized queries via $wpdb->prepare() for the ‘product_order’ parameter, or at minimum, properly escaping the value using esc_sql() or intval() if the expected value is an integer (like order IDs). The fix must ensure that user input is never directly concatenated into SQL queries.
The impact of successful exploitation is full read access to the WordPress database. An attacker could extract sensitive information such as usernames, password hashes (which could be cracked offline), user email addresses, and any other data stored in custom tables (including WooCommerce order and customer data if previously used). Although the CVSS vector indicates no impact on integrity or availability (I:N/A:N), the confidentiality breach alone can lead to further attacks, such as account compromise via password hash cracking.
