Avada WordPress theme fixes arbitrary file upload flaw
Take action: If you are using Avada WordPress theme, update it to the latest version, or disable file uploads.
Learn More
The Avada theme for WordPress, a product by ThemeFusion and one of ThemeForest's top-selling themes with nearly 950,000 sales, has fixed a high-severity Arbitrary File Upload Vulnerability.
The vulnerability, tracked as CVE-2023-39307 (CVSS score 8.8) is present in all Avada versions up to and including 7.11.4. It stems from the lack of file type validation within the `ajax_import_options()` function, allowing authenticated users with contributor-level access or higher the ability to upload arbitrary files to the server. This vulnerability could lead to remote code execution or overloading the server with massive files.
ThemeFusion released a patched version of the theme, version 7.11.5, on February 12th 2024. All plugin users are advised to patch ASAP.
