The vulnerability is a missing authorization flaw in the Avada theme that enables an attacker to access or modify theme settings without possessing the required administrative privileges. Based on the description, the flaw permits unauthorized users to alter or view configurations normally restricted to site administrators, thereby compromising the integrity and confidentiality of the site’s appearance and potentially allowing further exploitation. The weakness is classified as CWE‑862 for missing authorization.

WordPress installations that use ThemeFusion’s Avada theme version 7.11.10 or earlier. The flaw affects all sites that have not upgraded past this version threshold. No specific operating system or server platform is mentioned, so the issue applies broadly to any web server hosting such a WordPress site.

The CVSS score of 5.3 places this issue in the medium severity range. An EPSS score of less than 1% indicates a very low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web-based, with an attacker sending crafted requests to the theme’s configuration endpoints. Successful exploitation would give the attacker the ability to alter theme settings and possibly inject malicious content, impacting the integrity and trustworthiness of the site.