CVE-2024-13345: Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13345?
CVE-2024-13345 is considered a high severity vulnerability due to its potential for arbitrary shortcode execution.
How do I fix CVE-2024-13345?
To fix CVE-2024-13345, update the Avada Builder plugin to version 3.11.14 or later, which resolves the vulnerability.
What versions are affected by CVE-2024-13345?
CVE-2024-13345 affects all versions of the Avada Builder plugin up to and including 3.11.13.
What exploit techniques are associated with CVE-2024-13345?
CVE-2024-13345 allows for arbitrary shortcode execution, which can be exploited by unauthorized users to execute malicious code.
Is user authentication required to exploit CVE-2024-13345?
Exploitation of CVE-2024-13345 does not require user authentication, making it particularly dangerous.