The flaw is an authorization weakness in ThemeFusion Avada that permits users to invoke protected functions that should be restricted by access control lists. Because the theme fails to enforce proper ACL checks, an attacker may be able to access or modify content, settings, or data that should only be available to privileged users, potentially leading to unauthorized data disclosure or manipulation. The underlying weakness corresponds to CWE-862.

This issue affects the Avada WordPress theme supplied by ThemeFusion. All installed instances of Avada with version 7.13.2 or earlier are vulnerable, regardless of the WordPress core or other plugins.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not currently identified in the CISA KEV catalog. Based on the description, the likely attack vector involves manipulating authenticated requests to the theme’s administrative interface or sending crafted URLs to trigger the unprotected functionality; however, the exact method is not detailed in the available information and is inferred from typical broken access control scenarios.