CVE-2024-2340

MEDIUM NUCLEI

Avada < 7.11.7 - Information Disclosure

Title source: nuclei
STIX 2.1

Exploitation Summary

CVE-2024-2340 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

Nuclei Templates (1)

Avada < 7.11.7 - Information Disclosure
MEDIUMVERIFIEDby t3l3machus

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.2800
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-548
Status published
Products (2)
theme-fusion/avada < 7.11.7
ThemeFusion/Avada | Website Builder For WordPress & WooCommerce < 7.11.6
Published Apr 09, 2024
Tracked Since Feb 18, 2026