CVE-2024-1668

Published: Mar 13, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@wordfence.com (Secondary)

Description

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

Affected (1)

Products: Theme Fusion: Avada

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Theme Fusion Avada	Before 7.11.6

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1

Source: security@wordfence.com

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve

Source: security@wordfence.com

Third Party Advisory

https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.