What is the CVSS score of CVE-2025-64634?

CVE-2025-64634 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Avada are affected by CVE-2025-64634?

CVE-2025-64634 affects ThemeFusion Avada WordPress theme (versions through 7.13.2) and enables low-privilege authenticated users to bypass access controls and potentially compromise entire WordPress…

How to fix or mitigate CVE-2025-64634?

Within 24 hours: Identify all WordPress installations using ThemeFusion Avada theme and document current version numbers. Within 7 days: Implement principle of least privilege for all user accounts and disable Avada theme on non-critical sites if feasible; subscribe to ThemeFusion security advisories for patch availability. Within 30 days: Establish enhanced monitoring for suspicious admin activities and API calls from low-privilege accounts; prepare remediation plan for immediate theme update upon vendor patch release.

Avada CVE-2025-64634

MEDIUM

Missing Authorization (CWE-862)

2025-12-16 audit@patchstack.com

WordPress Authentication Bypass Avada Wordpress Theme Theme Fusion

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 16, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.

AnalysisAI

Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a weakness where the WordPress theme fails to implement proper authorization checks before granting access to sensitive functionality. The Avada theme, one of the most popular premium WordPress themes from theme-fusion, contains functions or endpoints that check whether a user is authenticated but fail to verify whether that authenticated user has appropriate permissions to access specific administrative or privileged features. The CPE identifier cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:* confirms this affects the WordPress implementation of Avada. This class of vulnerability is distinct from authentication bypass-attackers must have valid low-privilege credentials (such as subscriber or contributor accounts) but can then escalate to access restricted administrative functions or data that should require higher privilege levels like editor or administrator roles.

RemediationAI

Site administrators should immediately upgrade Avada theme to version 7.13.3 or later, which addresses the missing authorization checks. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/avada/vulnerability/wordpress-avada-theme-7-13-1-broken-access-control-vulnerability provides detailed vulnerability information and confirms patch availability. As an interim risk reduction measure for sites that cannot immediately upgrade, administrators should review user roles and disable new user registration if not business-critical, audit existing low-privilege user accounts for suspicious activity, and implement Web Application Firewall (WAF) rules to monitor for anomalous authenticated requests to administrative endpoints. However, these are temporary mitigations-upgrading remains the only complete remediation. Given Avada's status as a premium theme with automatic update capabilities, most installations should be able to apply patches through the standard WordPress theme update mechanism once the license is active.