CVE-2024-13346: Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

Q: What is the severity of CVE-2024-13346?

CVE-2024-13346 is classified as a high severity vulnerability due to its potential for arbitrary shortcode execution.

Q: How do I fix CVE-2024-13346?

To fix CVE-2024-13346, update the Avada theme to version 7.11.14 or later.

Q: What versions of Avada are affected by CVE-2024-13346?

All versions of Avada up to and including 7.11.13 are affected by CVE-2024-13346.

Q: What type of vulnerability is CVE-2024-13346?

CVE-2024-13346 is an arbitrary shortcode execution vulnerability.

Q: Who is the vendor associated with CVE-2024-13346?

The vendor associated with CVE-2024-13346 is ThemeFusion.

Published Feb 13, 2025

Updated

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected Software

2 affected components

Theme-fusion Avada Wordpress<7.11.14

ThemeFusion Avada<=7.11.13

Event History

Feb 13, 2025

CVE Published

via MITRE·06:58 AM

Data Sourced

via MITRE·06:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-13346?

CVE-2024-13346 is classified as a high severity vulnerability due to its potential for arbitrary shortcode execution.

How do I fix CVE-2024-13346?

To fix CVE-2024-13346, update the Avada theme to version 7.11.14 or later.

What versions of Avada are affected by CVE-2024-13346?