The Enfold - Responsive Multi-Purpose Theme for WordPress contains an improper access control vulnerability (CWE-284) due to a missing capability check in avia-export-class.php in all versions up to and including 6.0.9. This flaw permits unauthenticated attackers to export the theme's avia settings, potentially exposing sensitive credentials such as Mailchimp API keys, reCAPTCHA secret keys, or Envato private tokens. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss without integrity or availability impact. No vendor patch or official fix information is provided in the available data.

An attacker can remotely and without authentication export the theme's avia settings, potentially gaining access to sensitive information like API keys and private tokens stored in these settings. This confidentiality breach could lead to further misuse of exposed credentials. There is no indication of impact on integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the export functionality by limiting public access to the affected files or disabling the export feature if possible. Monitor official Kriesi communications for updates and apply patches promptly once available.