CVE-2024-2340 Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

What is CVE-2024-2340?

CVE-2024-2340 is a medium-severity vulnerability in ThemeFusion Avada | Website Builder For WordPress & WooCommerce, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

Weakness: CWE-548

Which versions are affected by CVE-2024-2340?

It affects 1 product.

Products include Theme-Fusion Avada.

How do I fix CVE-2024-2340?

No fix has been published for CVE-2024-2340 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-2340 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2340 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in ThemeFusion Avada | Website Builder For WordPress & WooCommerce

• CVE-2023-39312 WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability Critical 9.1
• CVE-2024-1468 Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2022-41996 WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability High 8.8
• CVE-2017-18607 Cross-site request forgery in n/a High 8.8
• CVE-2023-39307 WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wvrc-7835-9grj.