CVE

CVE-2024-2340

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

avada | website builder for wordpress & woocommerceavada

Updated Sep 18, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2024-2340 Scanner

CVE-2024-2340 scanner - Information Disclosure vulnerability in Avada

Used 2.6k times · 5.9k assets checked · url

Scanner page →Run scanner

CVE history: avada | website builder for wordpress & woocommerce

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →