CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.
Explanation of Vulnerability in Simple Terms
Avada versions up to 7.11.6 expose sensitive information through improper access controls. An unauthenticated attacker can read non-public data by sending network requests to the site. This affects all installations of the plugin without a patch applied. Site owners should update immediately to protect user data and site configuration details.
What an attacker can do
Read sensitive site data and configuration without authentication.
Potential impact on your site
Sensitive information (user data, site config) may be exposed to anyone on the internet.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
