Avada < 7.11.2 - Subscriber+ Portfolio Permalinks Creation

2024-01-3000:00:00

wpscan.com

avada security portfolio perms

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The theme is vulnerable to unauthorized modification of data due to a missing capability check, allowing any authenticated attackers, with such as subscriber and above, to save Portfolio permalinks.

CPENameOperatorVersion
eq7.11.2
eq7.11.2

CPE	Name	Operator	Version
		eq	7.11.2
		eq	7.11.2

References

patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-broken-access-control-vulnerability