Key detail from CVE description: ThemeFusion Avada Core fusion‑core contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The flaw permits unauthenticated or improperly authorized users to perform privileged actions, potentially enabling view, modification, or deletion of content and settings that should be restricted to administrators.

Affected systems: The vulnerability targets ThemeFusion’s Avada Core plugin. The affected package range is from the first released version through any release prior to v5.15.0. Thus, any WordPress installation running Avada Core earlier than 5.15.0 is susceptible.

Risk and exploitability: The CVSS v3.1 score of 5.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The record does not disclose any publicly available exploits or special prerequisites. Based on the nature of the flaw, the attack vector is likely remote and involves crafting HTTP requests to the plugin’s administrative endpoints, a scenario that is inferred from the plugin’s role as a WordPress component.