SB2020050409 - Multiple vulnerabilities in Avada WordPress theme

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Stored cross-site scripting (CVE-ID: N/A)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "update_layout" function in the "fusion-builder/inc/class-fusion-builder-library.php" script. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

2) Permissions, Privileges, and Access Controls (CVE-ID: N/A)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to improper permissions checks in the "delete_layout" function. A remote authenticated attacker can delete any post or page on the website.

3) Permissions, Privileges, and Access Controls (CVE-ID: N/A)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to improper permissions checks in the "fusion_builder_save_layout" AJAX action used to call the "save_layout" function. A remote authenticated attacker can create a post, select several parameters (post type, post status, slug etc), as well as inject JavaScript code with the [fusion_code] attribute.

Remediation

Install update from vendor's website.

References

• https://wpvulndb.com/vulnerabilities/10209/
• https://blog.nintechnet.com/avada-wordpress-theme-fixed-multiple-vulnerabilities/