Themes Vulnerabilities

Avada < 7.11.2 - Contributor+ Arbitrary File Upload

Description

The theme is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_import_options' function, making it possible for authenticated attackers with contributor permissions to upload arbitrary files on the affected site's server which may make remote code execution possible if they can successfully exploit a race condition.

Affects Themes

Avada
Fixed in 7.11.2
avada
Fixed in 7.11.2

References

CVE
CVE-2023-39307
URL
https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-arbitrary-file-upload-vulnerability

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
6.6 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
6a819332-0b24-40f6-9cc5-06712dd1595b

Timeline

Publicly Published
2024-01-29 (about 2 years ago)
Added
2024-01-30 (about 2 years ago)
Last Updated
2024-01-30 (about 2 years ago)

Other

Published
Title
Published
2023-11-28
Title
WCMultiShipping < 2.3.8 - Subscriber+ Arbitrary Account Credentials Test
Published
2022-02-17
Title
UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download
Published
2024-10-24
Title
Mapster WP Maps < 1.6.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update
Published
2021-10-27
Title
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
Published
2026-01-09
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.7.3 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure