CVE-2024-2340 - Vulnerability Details - OpenCVE

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.58179.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ThemeFusion

Avada | Website Builder For WordPress & WooCommerce

unaffected

Version	Status	Constraints
`*`	affected	≤ 7.11.6

Configuration 1 [-]

cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*

No data.

No data.

Subscriptions

Vendors	Products
Theme-fusion Subscribe	Avada Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://avada.com/documentation/avada-changelog/
https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve

History

Thu, 26 Feb 2026 14:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:theme-fusion:avada::::::::
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 31 Jan 2025 02:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Theme-fusion Theme-fusion avada
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:theme-fusion:avada::::::wordpress::*
Vendors & Products		Theme-fusion Theme-fusion avada

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-04-09T18:59:06.567Z

Updated: 2024-08-08T18:27:14.000Z

Reserved: 2024-03-08T20:06:51.188Z

Link: CVE-2024-2340

Vulnrichment

Updated: 2024-08-01T19:11:53.384Z

NVD

Status : Analyzed

Published: 2024-04-09T19:15:32.520

Modified: 2025-01-31T01:57:32.613

Link: CVE-2024-2340

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-noinfo

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2340", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-03-08T20:06:51.188Z", "datePublished": "2024-04-09T18:59:06.567Z", "dateUpdated": "2024-08-08T18:27:14.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-04-09T18:59:06.567Z"}, "affected": [{"vendor": "ThemeFusion", "product": "Avada | Website Builder For WordPress & WooCommerce", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "7.11.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism."}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve"}, {"url": "https://avada.com/documentation/avada-changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-548 Information Exposure Through Directory Listing"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "timeline": [{"time": "2024-03-20T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.384Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve", "tags": ["x_transferred"]}, {"url": "https://avada.com/documentation/avada-changelog/", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "theme-fusion", "product": "avada", "cpes": ["cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.11.7", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-08T18:25:37.807880Z", "id": "CVE-2024-2340", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T18:27:14.000Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve", "tags": ["x_transferred"]}, {"url": "https://avada.com/documentation/avada-changelog/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.384Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-08T18:25:37.807880Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:*:*:*"], "vendor": "theme-fusion", "product": "avada", "versions": [{"status": "affected", "version": "0", "lessThan": "7.11.7", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T18:27:09.011Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "ThemeFusion", "product": "Avada | Website Builder For WordPress & WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "7.11.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-03-20T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve"}, {"url": "https://avada.com/documentation/avada-changelog/"}], "descriptions": [{"lang": "en", "value": "The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-548 Information Exposure Through Directory Listing"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-04-09T18:59:06.567Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2340", "state": "PUBLISHED", "dateUpdated": "2024-08-08T18:27:14.000Z", "dateReserved": "2024-03-08T20:06:51.188Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-04-09T18:59:06.567Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "EA3C3037-32CE-484C-951A-3DAAFA229C13", "versionEndExcluding": "7.11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism."}, {"lang": "es", "value": "El tema Avada para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en todas las versiones hasta la 7.11.6 incluida a trav\u00e9s del directorio '/wp-content/uploads/fusion-forms/'. Esto hace posible que atacantes no autenticados extraigan datos confidenciales cargados a trav\u00e9s de un formulario creado por Avada con un mecanismo de carga de archivos."}], "id": "CVE-2024-2340", "lastModified": "2025-01-31T01:57:32.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2024-04-09T19:15:32.520", "references": [{"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://avada.com/documentation/avada-changelog/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://avada.com/documentation/avada-changelog/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}