CVE-2024-2340
Published: 09 April 2024
Summary
CVE-2024-2340 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Theme-Fusion Avada. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Avada theme for WordPress is vulnerable to sensitive information exposure in all versions through 7.11.6. The flaw resides in the publicly accessible /wp-content/uploads/fusion-forms/ directory, which stores files uploaded through forms created with the theme's Fusion Builder file-upload feature. Unauthenticated remote attackers can directly enumerate and retrieve these files, exposing any data submitted through the affected forms.
Because the directory lacks access controls, an attacker needs only network reachability and knowledge of the upload path to read submitted content. Successful exploitation yields disclosure of potentially sensitive user-supplied information such as documents or personal data, but does not permit modification or deletion of files.
The referenced Avada changelog and Wordfence advisory indicate that the issue is addressed in subsequent theme releases; site operators should apply the latest Avada update to restrict directory access.
The EPSS score stands at 0.6395 with no material increase from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27294
Vulnerability details
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form…
more
with a file upload mechanism.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects information exposure through directory listings as unauthorized disclosure.
Directory listings and resource enumeration can be suppressed or populated with misleading entries.
Reduces exposure via directory listings or accessible files when OPSEC restricts visibility of key organizational resources.