Skip to content

Instantly share code, notes, and snippets.

@Xib3rR4dAr

Xib3rR4dAr/avada_fusion_builder_poc.md Secret

Created February 14, 2024 12:12
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Xib3rR4dAr/91bd37338022b15379f393356d1056a1 to your computer and use it in GitHub Desktop.
Save Xib3rR4dAr/91bd37338022b15379f393356d1056a1 to your computer and use it in GitHub Desktop.
Download ZIP
Avada <=7.11.4 / Fusion-Builder <= 3.11.4 Improper Access Control
Raw
avada_fusion_builder_poc.md

Avada <=7.11.4 / Fusion-Builder <= 3.11.4 Improper Access Control

Exploit Author: Muhammad Zeeshan (Xib3rR4dAr)

Description

In Avada theme, fusion-builder plugin is required for operation and allows contributor users to add forms. It is found that contributor users can view form submissions for forms that are created by other users or admin users by visiting /wp-admin/admin.php?page=avada-forms.

Fix

Less privileged users should not be allowed to view submissions of forms created by other users or admin users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment