What’s Vulnerable › Vulnerabilities

CVE-2024-2340: Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 28.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-09 · updated 2026-06-17
• Weakness: CWE-548

Description

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

Affected products

• ThemeFusion Avada | Website Builder For WordPress & WooCommerce: before 7.11.7 — fixed in 7.11.7

How to fix

Upgrade to a fixed version: ThemeFusion Avada | Website Builder For WordPress & WooCommerce 7.11.7. Check the vendor advisory for mitigations.

References

• https://avada.com/documentation/avada-changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve
• https://avada.com/documentation/avada-changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve

Get alerted when CVE-2024-2340 or the next vulnerability affects your stack