Server-Side Request Forgery in Avada Website Builder for WordPress

CVE-2024-2343

Summary

The Avada Website Builder for WordPress is exposed to vulnerabilities in its functionality, allowing authenticated users with contributor-level access and above to conduct Server-Side Request Forgery (SSRF) attacks. This flaw exists within the form_to_url_action function, enabling attackers to send unauthorized web requests to arbitrary locations. Such access can potentially compromise sensitive information and modify data in internal services, highlighting the importance of security patches and vigilance in maintaining WordPress applications.

References