CVE-2023-39309: WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerability
Published Mar 28, 2024
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Affected Software
3 affected components
ThemeFusion Fusion Builder<=3.11.1
WordPress Avada Builder<=3.11.1
Avada Fusion Builder Wordpress<=3.11.1
Remediation
Information
Update to 3.11.2 or a higher version.
Event History
Mar 28, 2024
CVE Published
via MITRE·06:43 AM
Data Sourced
via MITRE·06:43 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-39309?
CVE-2023-39309 is classified as a critical SQL Injection vulnerability affecting ThemeFusion Fusion Builder.
2
How do I fix CVE-2023-39309?
To fix CVE-2023-39309, update Fusion Builder to version 3.11.2 or later.
3
What types of applications are affected by CVE-2023-39309?
CVE-2023-39309 affects ThemeFusion Fusion Builder and the WordPress Avada Builder plugin.
4
What versions of ThemeFusion Fusion Builder are vulnerable to CVE-2023-39309?
Versions of ThemeFusion Fusion Builder from n/a to 3.11.1 are vulnerable to CVE-2023-39309.
5
Can exploiting CVE-2023-39309 lead to data compromise?
Yes, exploiting CVE-2023-39309 can allow attackers to perform unauthorized SQL queries, potentially compromising sensitive data.