{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32453", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:11:40.509Z", "datePublished": "2026-03-13T11:42:21.829Z", "dateUpdated": "2026-04-29T09:51:59.866Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://themeforest.net", "defaultStatus": "unaffected", "packageName": "fusion-core", "product": "Avada Core", "vendor": "ThemeFusion", "versions": [{"changes": [{"at": "5.15.0", "status": "unaffected"}], "lessThanOrEqual": "5.15.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bonds | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:06:11.736Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Avada Core: from n/a through < 5.15.0.</p>"}], "value": "Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:59.866Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/fusion-core/vulnerability/wordpress-avada-core-plugin-5-15-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:46:47.092485Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:53:33.921Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:46:47.092485Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:46:47.821Z"}}], "cna": {"title": "WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Bonds | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "ThemeFusion", "product": "Avada Core", "versions": [{"status": "affected", "changes": [{"at": "5.15.0", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "< 5.15.0"}], "packageName": "fusion-core", "collectionURL": "https://themeforest.net", "defaultStatus": "unaffected"}], "datePublic": "2026-03-13T12:41:24.638Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/fusion-core/vulnerability/wordpress-avada-core-plugin-5-15-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Avada Core: from n/a through < 5.15.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-13T11:42:21.829Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32453", "state": "PUBLISHED", "dateUpdated": "2026-03-13T18:53:33.921Z", "dateReserved": "2026-03-12T11:11:40.509Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-13T11:42:21.829Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en ThemeFusion Avada Core fusion-core permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Avada Core: desde n/a hasta &lt; 5.15.0."}], "id": "CVE-2026-32453", "lastModified": "2026-04-22T21:30:26.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-13T19:55:06.883", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/fusion-core/vulnerability/wordpress-avada-core-plugin-5-15-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "Avada Core", "source": "cna", "vendor": "ThemeFusion"}, "product": "avada", "vendor": "theme-fusion"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-19T17:05:20.477041+00:00", "value": {"mitigation_remediation": ["Upgrade Avada Core to version 5.15.0 or later to remove the missing authorization flaw.", "If an upgrade is not immediately possible, restrict access to the plugin\u2019s administrative URLs by configuring your web server or firewall to allow requests only from trusted IP addresses or by requiring authentication, thereby limiting exposure.", "Verify that the installed plugin version matches the latest release by checking the WordPress plugin repository or the vendor\u2019s site.", "Monitor WordPress logs for unexpected access attempts to the plugin\u2019s admin area and block offending IP addresses to mitigate potential attacks."], "summary": {"action": "Apply Patch", "impact": "Broken Access Control \u2013 Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Affected systems: The vulnerability targets ThemeFusion\u2019s Avada Core plugin. The affected package range is from the first released version through any release prior to v5.15.0. Thus, any WordPress installation running Avada Core earlier than 5.15.0 is susceptible.", "description_and_impact": "Key detail from CVE description: ThemeFusion Avada Core fusion\u2011core contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The flaw permits unauthenticated or improperly authorized users to perform privileged actions, potentially enabling view, modification, or deletion of content and settings that should be restricted to administrators.", "risk_and_exploitability": "Risk and exploitability: The CVSS v3.1 score of 5.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. The record does not disclose any publicly available exploits or special prerequisites. Based on the nature of the flaw, the attack vector is likely remote and involves crafting HTTP requests to the plugin\u2019s administrative endpoints, a scenario that is inferred from the plugin\u2019s role as a WordPress component."}}}}, "created": "2026-03-16T09:25:41.230173+00:00", "updated": "2026-03-23T12:03:12.628765+00:00", "vendors": ["theme-fusion", "theme-fusion$PRODUCT$avada", "wordpress", "wordpress$PRODUCT$wordpress"]}