Description (CNA)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| themefusion / Avada (Fusion) Builder | affected 0 through 3.16.1 |
CWE
CWE-200
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbd41a8-b9ff-4afe-bcfd-1df52d8d3b5f?source=cve
- https://avada.com/blog/version-7-16-2-security-update/
ADP enrichment
No English description supplied.
No references supplied.