CVE-2024-1668 Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries

What is CVE-2024-1668?

CVE-2024-1668 is a medium-severity vulnerability in ThemeFusion Avada | Website Builder For WordPress & WooCommerce, published on 13 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

Weakness: CWE-284

Which versions are affected by CVE-2024-1668?

It affects 1 product.

Products include Theme-Fusion Avada.

How do I fix CVE-2024-1668?

No fix has been published for CVE-2024-1668 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-1668 being exploited?

There is no known exploitation of CVE-2024-1668 in the wild and no public exploit code.

Other vulnerabilities in ThemeFusion Avada | Website Builder For WordPress & WooCommerce

• CVE-2023-39312 WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability Critical 9.1
• CVE-2024-1468 Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2022-41996 WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability High 8.8
• CVE-2017-18607 Cross-site request forgery in n/a High 8.8
• CVE-2023-39307 WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pxwf-ppfx-m7xm.