Avada < 7.11.2 - Contributor+ Arbitrary File Upload

Description The theme is vulnerable to arbitrary file uploads due to missing file type validation in the ‘ajax_import_options’ function, making it possible for authenticated attackers with contributor permissions to upload arbitrary files on the affected site’s server which may make remote code execution possible if they can successfully exploit a race condition.