{"id":"CVE-2025-24748","aliases":["EUVD-2025-19957","GHSA-33pw-99cq-v6w5"],"status":"published","title":"WordPress Avada theme \u003c= 7.11.10 - Broken Access Control vulnerability","description":"Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through \u003c= 7.11.10.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00263,"percentile":0.18296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862","CWE-89"],"published":"2025-07-04T08:42:05Z","modified":"2026-06-17T08:59:32Z","products":[{"vendor":"themefusion","product":"avada"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Theme/avada/vulnerability/wordpress-avada-theme-7-11-10-broken-access-control-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24748"},{"url":"https://patchstack.com/database/wordpress/plugin/all_in_one_carousel/vulnerability/wordpress-all-in-one-slider-responsive-plugin-3-7-9-sql-injection-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-33pw-99cq-v6w5"}],"sources":{"cve":[{"id":"CVE-2025-24748","title":"WordPress Avada theme \u003c= 7.11.10 - Broken Access Control vulnerability","description":"Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through \u003c= 7.11.10.","status":"published","published":"2025-07-04T08:42:05.486Z","modified":"2026-04-28T16:11:33.929Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-19957","description":"Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through \u003c= 7.11.10.","status":"published","published":"2025-07-04T08:42:05Z","modified":"2026-04-28T16:11:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:51.293584Z"}],"ghsa":[{"id":"GHSA-33pw-99cq-v6w5","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup All In One Slider Responsive allows SQL Injection. This issue affects All In One Slider Responsive: from n/a through 3.7.9.","status":"published","published":"2025-07-04T09:31:15Z","modified":"2026-04-01T18:37:06Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-89","CWE-862"],"updated_at":"2026-11-02T15:07:04.310482Z"}],"nvd":[{"id":"CVE-2025-24748","description":"Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through \u003c= 7.11.10.","status":"published","published":"2025-07-04T09:15:26.97Z","modified":"2026-06-17T08:59:32.603Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:15.754475Z"}]}}