Avada Core CVE-2026-32453

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a moderate but exploitable vulnerability: network-accessible, low attack complexity, requiring no privileges or user interaction, with limited integrity impact but no confidentiality or availability impact. While the CVSS base score of 5.3 falls in the medium range, the absence of authentication requirements (PR:N) and the straightforward network attack vector (AV:N) suggest practical exploitability. However, the limited scope (confined to the affected system) and absence of confidentiality or availability impact prevent this from being critical. The real-world risk depends on whether the affected authorization checks control sensitive functions (theme customization, settings modification, or data manipulation) or minor features. For widely-deployed WordPress themes like Avada, even medium-severity authorization flaws can affect thousands of websites if not promptly patched. Without confirmation of active exploitation or KEV status, this should be treated as a moderate-priority vulnerability requiring timely patching.

An attacker discovers a WordPress site running Avada Core version 5.14.x and identifies that the theme's customization or settings endpoint lacks proper authorization checks. The attacker sends a crafted HTTP request (POST or GET) directly to the affected endpoint without authentication, specifying modifications to critical theme settings such as customization options, widget configurations, or theme behavior parameters. Because the access control is misconfigured, the request succeeds, allowing the attacker to deface the site, inject malicious content, redirect users to phishing pages, or alter website functionality. The attack requires no user interaction and can be automated as part of mass exploitation of vulnerable Avada installations.