Arbitrary File Uploads Vulnerability Affects Avada Website Builder

CVE-2024-1468

What is CVE-2024-1468?

The Avada Website Builder for WordPress & WooCommerce theme has a vulnerability that allows authenticated users with contributor-level access and above to perform arbitrary file uploads. This security flaw originates from inadequate file type validation in the ajax_import_options() function, present in all versions up to and including 7.11.4. If exploited, this vulnerability could lead to unauthorized files being uploaded to the server, potentially enabling remote code execution and other malicious activities. Website administrators are urged to take immediate action to mitigate associated risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References