The Avada | Website Builder For WordPress & WooCommerce theme for WordPress contains a code injection vulnerability (CWE-94) identified as CVE-2024-13346. The issue arises because the theme improperly controls the generation of code by allowing execution of arbitrary shortcodes without validating input. This flaw enables unauthenticated attackers to execute arbitrary shortcode actions, potentially impacting the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability affects all versions up to 7.11.13. The CVSS v3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No vendor advisory or patch links are currently available.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes on a vulnerable WordPress site using the Avada theme. This can lead to partial compromise of confidentiality, integrity, and availability of the site. The CVSS score of 7.3 indicates a high severity impact. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeFusion's official channels for updates. Until a fix is available, consider restricting access to vulnerable endpoints or disabling shortcode execution if feasible as a temporary mitigation.