PT-2025-7820 · WordPress · Enfold

Michael Mazzolini + 1 · Published 2025-02-25 · Updated 2025-02-28 · CVE-2024-13693

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

Enfold theme for WordPress versions up to, and including, 6.0.9

Description:

The issue allows unauthorized access to data due to a missing capability check in the avia-export-class.php file. This enables unauthenticated attackers to export all avia settings, potentially including sensitive information such as the `Mailchimp API Key`, `reCAPTCHA Secret Key`, or `Envato private token` if they are set.

Recommendations:

For Enfold theme for WordPress versions up to, and including, 6.0.9, update to a version higher than 6.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the avia-export-class.php file to minimize the risk of exploitation.

Fix

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-862

CWE-284

Related Identifiers

CVE-2024-13693

Affected Products

Enfold

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13693 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/61a9ad18-28d4-488c-b3a7-e35745f9c83e?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1894335813502071023 · Twitter Post
• https://t.me/cvedetector/18864 · Telegram Post
• https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990#item-description__changelog · Note
• https://twitter.com/CVEnew/status/1894322263035666507 · Twitter Post
• https://t.me/cvenotify/112401 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13693 · Note
• https://t.me/cvenotify/112735 · Telegram Post