CVE-2024-1668

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1668
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve Third Party Advisory
https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*
History

31 Jan 2025, 13:48

Type Values Removed Values Added
References () https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 - () https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 - Third Party Advisory
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve - Third Party Advisory
First Time Theme-fusion
Theme-fusion avada
CPE cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*
CWE NVD-CWE-noinfo

21 Nov 2024, 08:51

Type Values Removed Values Added
Summary
  • (es) El Avada | El tema Website Builder para WordPress y WooCommerce para WordPress es vulnerable a la exposición de información confidencial en versiones hasta la 7.11.5 incluida a través de la página de entradas del formulario. Esto hace posible que atacantes autenticados, con acceso de colaborador y superior, vean el contenido de todos los envíos de formularios, incluidos los campos que están ofuscados (como el campo "contraseña" del formulario de contacto).
References () https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 - () https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1 -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve -

13 Mar 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-13 16:15

Updated : 2025-01-31 13:48

NVD link : CVE-2024-1668

Mitre link : CVE-2024-1668

CVE.ORG link : CVE-2024-1668

JSON object : View

Products Affected

theme-fusion

  • avada
CWE
NVD-CWE-noinfo