CVE-2024-2340
Medium · 5.3CVSS
5.3
EPSS
28.0%
Published
Apr 9, 2024
CISA due date
—
The record
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19987 A security vulnerability has been detected in SourceCodester Best Employee Management… CWE-548
- CVE-2026-50233 Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its… CWE-548
- CVE-2025-32750 Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through… CWE-548
- CVE-2026-41933 Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability… CWE-548
- CVE-2026-22860 Rack is a modular Ruby web server interface. CWE-548
- CVE-2023-38265 IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose… CWE-548
- CVE-2020-36921 RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability… CWE-548
- GHSA-c5cj-xp43-qcc3 Moodle's error handling leads to sensitive information disclosure CWE-548