Avada Theme Vulnerable to SQL Injection

CVE-2024-2344

Summary

The Avada theme for WordPress, developed by ThemeFusion, is exposed to a SQL Injection vulnerability due to improper handling of the 'entry' parameter. This security flaw, present in all versions up to and including 7.11.6, arises from insufficient sanitization and escaping of user input, leading to the potential for authenticated attackers with editor-level access or higher to manipulate existing SQL queries. Consequently, this may allow them to append malicious SQL commands, enabling them to extract sensitive information stored within the database, thereby compromising the security of WordPress sites utilizing this theme.

References