CVE-2024-2340
Info Disclosure in Theme-Fusion Avada ≤ 7.11.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-2340 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Theme-Fusion Avada. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Avada theme for WordPress is vulnerable to sensitive information exposure in all versions through 7.11.6. The flaw resides in the publicly accessible /wp-content/uploads/fusion-forms/ directory, which stores files uploaded through forms created with the theme's Fusion Builder file-upload feature. Unauthenticated remote attackers can directly enumerate and retrieve these files, exposing any data submitted through the affected forms.
Because the directory lacks access controls, an attacker needs only network reachability and knowledge of the upload path to read submitted content. Successful exploitation yields disclosure of potentially sensitive user-supplied information such as documents or personal data, but does not permit modification or deletion of files.
The referenced Avada changelog and Wordfence advisory indicate that the issue is addressed in subsequent theme releases; site operators should apply the latest Avada update to restrict directory access.
The EPSS score stands at 0.6395 with no material increase from its recorded peak.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27294
Vulnerability Data
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form…
more
with a file upload mechanism.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure baseline settings that disable directory listing on servers and file shares.
Restricts unnecessary server features such as automatic directory indexing.
Enforces authorization decisions so that directory listings are never returned unless explicitly permitted.
Controls information flows so directory contents are not disclosed to unauthorized recipients.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and config management directly disable directory listing by default.
Lifecycle management includes applying secure configurations that would prevent directory exposure.
Vulnerability scanning can discover exposed directories so they can be remediated.
Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
Security testing in development and acceptance can detect and require remediation of exposed directory listings.
Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
Secure development life cycle includes configuration hardening that disables directory listing in production web servers.
Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
Secure system architecture principles include configuring web servers to prevent automatic directory listings.