The Avada WordPress theme up to version 7.11.6 contains a directory listing vulnerability (CWE-548) in the '/wp-content/uploads/fusion-forms/' path. This flaw permits unauthenticated attackers to enumerate and retrieve sensitive files uploaded via Avada's form upload mechanism, leading to exposure of potentially sensitive data. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low complexity and no privileges required, impacting confidentiality but not integrity or availability.

An attacker can obtain sensitive information uploaded through Avada forms by accessing the exposed directory listing without authentication. This compromises confidentiality of the data stored in the affected directory. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting public access to the '/wp-content/uploads/fusion-forms/' directory via web server configuration (e.g., disabling directory listing or restricting access) to prevent unauthorized file enumeration.