CVE-2024-13693 Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php
Unauthenticated attackers can export sensitive configuration data, including API keys and tokens, from the Enfold WordPress theme.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13693?
CVE-2024-13693 is a medium-severity missing authorization vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set.
Which versions are affected by CVE-2024-13693?
It affects 1 product.
Products include Kriesi Enfold.
How do I fix CVE-2024-13693?
No fix has been published for CVE-2024-13693 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-13693 being exploited?
There is no known exploitation of CVE-2024-13693 in the wild and no public exploit code.
Other vulnerabilities in Kriesi Enfold - Responsive Multi-Purpose Theme
- CVE-2014-7297 Other in n/a
- CVE-2024-37199 WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-38400 WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-13695 Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id
- CVE-2024-5061 Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters
Sources
Also known as GHSA-p2vq-q8r6-6mg3.