CVE-2024-1468: Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions() function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1468?
CVE-2024-1468 is considered a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-1468?
To fix CVE-2024-1468, upgrade your Avada theme to version 7.11.5 or later.
Who is affected by CVE-2024-1468?
CVE-2024-1468 affects all versions of the Avada Website Builder up to and including 7.11.4.
What type of attack can exploit CVE-2024-1468?
CVE-2024-1468 can be exploited by authenticated attackers to upload arbitrary files to the server.
What specific function is responsible for CVE-2024-1468?
The ajax_import_options() function contains the vulnerability that allows arbitrary file uploads in CVE-2024-1468.