critical
advisory
Theme-fusion Avada: Unauthenticated arbitrary shortcode execution (CVE-2024-13346)
CVE-2024-13346 affects Theme-fusion Avada versions prior to 7.11.14, allowing unauthenticated arbitrary shortcode execution. A public exploit is available.
CVE search metadata
CVE search record: CVE-2024-13346. Severity: high. CVSS: 7.3. EPSS: 2.30%. KEV: no. Product: Avada (< 7.11.14). Brief: Theme-fusion Avada: Unauthenticated arbitrary shortcode execution (CVE-2024-13346). Brief link: https://feed.craftedsignal.io/briefs/2026-10-avada-theme-rce/
Triage facts
Revision 1- Applicability
- Avada (< 7.11.14)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 29, 14:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2024-13346 allows unauthenticated arbitrary shortcode execution in Theme-fusion Avada versions prior to 7.11.14. A public exploit or PoC has been published on Sploitus. The vulnerability has a CVSS score of 9.8 and an EPSS score of 2.3%.