The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to submit requests on behalf of a logged‑in WordPress user. By exploiting improper verification of request authenticity, a malicious actor may trigger actions that the user performed, potentially altering site settings or other data. The weakness is identified as CWE‑352 and carries a CVSS score of 4.3, indicating moderate severity. Based on the description, it is inferred that the flaw causes the request to be processed without proper CSRF token validation.

WordPress sites that use the Avada theme from ThemeFusion, specifically any version earlier than 7.13.2.

The CVSS score reflects a moderate risk, and the EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need to trick an authenticated user into visiting a crafted link or submitting a malicious form—a vector that relies on user interaction and, therefore, may be limited in scope. Nonetheless, once compromised, the attacker can perform unauthorized actions on the site.