CVE-2024-1668CWE-284

Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries

Medium · published March 13, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00658 · 50.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-03-13T15:32Z
EPSS history
Timeline
  • 13 MAR 15:32Z
    Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
    cvelistv5