CVE-2024-1668

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1	Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve	Third Party Advisory
https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1	Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*

History

31 Jan 2025, 13:48

Type	Values Removed	Values Added
First Time		Theme-fusion Theme-fusion avada
References	~~() https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 -~~	() https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 - Third Party Advisory
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve - Third Party Advisory
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:theme-fusion:avada::::::wordpress::*

Information

Published : 2024-03-13 16:15

Updated : 2025-01-31 13:48

NVD link : CVE-2024-1668

Mitre link : CVE-2024-1668

CVE.ORG link : CVE-2024-1668

JSON object : View

Products Affected

theme-fusion

avada

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-1668", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-03-13T16:15:25.510", "references": [{"url": "https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's \"password\" field)."}, {"lang": "es", "value": "El Avada | El tema Website Builder para WordPress y WooCommerce para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en versiones hasta la 7.11.5 incluida a trav\u00e9s de la p\u00e1gina de entradas del formulario. Esto hace posible que atacantes autenticados, con acceso de colaborador y superior, vean el contenido de todos los env\u00edos de formularios, incluidos los campos que est\u00e1n ofuscados (como el campo \"contrase\u00f1a\" del formulario de contacto)."}], "lastModified": "2025-01-31T13:48:12.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0DBAB261-B343-4EF4-8A9E-3A393ABC7E24", "versionEndExcluding": "7.11.6"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}