CVE-2022-41996 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Theme-fusion	Avada

Configuration 1 [-]

cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
https://theme-fusion.com/documentation-assets/avada/changelog.txt
https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226

History

Fri, 21 Feb 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-10-27T16:51:42.567Z

Updated: 2025-02-20T19:58:04.580Z

Reserved: 2022-10-19T00:00:00.000Z

Link: CVE-2022-41996

Vulnrichment

Updated: 2024-08-03T12:56:39.270Z

NVD

Status : Modified

Published: 2022-10-27T17:15:10.650

Modified: 2024-11-21T07:24:14.280

Link: CVE-2022-41996

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-41996", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "datePublished": "2022-10-27T16:51:42.567Z", "dateUpdated": "2025-02-20T19:58:04.580Z", "dateReserved": "2022-10-19T00:00:00.000Z"}, "containers": {"cna": {"title": "WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability", "datePublic": "2022-10-20T00:00:00.000Z", "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2022-10-27T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation."}], "affected": [{"vendor": "ThemeFusion", "product": "Avada (premium WordPress theme)", "versions": [{"version": "<= 7.8.1", "status": "affected", "lessThanOrEqual": "7.8.1", "versionType": "custom"}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}, {"url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt"}, {"url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226"}], "credits": [{"lang": "en", "value": "Vulnerability discovered by Dave Jong (Patchstack)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Update to 7.8.2 or higher version."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:39.270Z"}, "title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["x_transferred"]}, {"url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt", "tags": ["x_transferred"]}, {"url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-20T19:17:22.483793Z", "id": "CVE-2022-41996", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T19:58:04.580Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["x_transferred"]}, {"url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt", "tags": ["x_transferred"]}, {"url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:39.270Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-41996", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-20T19:17:22.483793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T19:17:24.529Z"}}], "cna": {"title": "WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Vulnerability discovered by Dave Jong (Patchstack)"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ThemeFusion", "product": "Avada (premium WordPress theme)", "versions": [{"status": "affected", "version": "<= 7.8.1", "versionType": "custom", "lessThanOrEqual": "7.8.1"}]}], "solutions": [{"lang": "en", "value": "Update to 7.8.2 or higher version."}], "datePublic": "2022-10-20T00:00:00.000Z", "references": [{"url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}, {"url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt"}, {"url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2022-10-27T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-41996", "state": "PUBLISHED", "dateUpdated": "2025-02-20T19:58:04.580Z", "dateReserved": "2022-10-19T00:00:00.000Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2022-10-27T16:51:42.567Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "04ECBF66-134A-4545-89BC-09C64974FBD3", "versionEndIncluding": "7.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el tema premium del ThemeFusion Avada en versiones <= 7.8.1 en WordPress, lo que provoca la instalaci\u00f3n/activaci\u00f3n arbitraria de complementos."}], "id": "CVE-2022-41996", "lastModified": "2024-11-21T07:24:14.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-27T17:15:10.650", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt"}, {"source": "audit@patchstack.com", "tags": ["Product"], "url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://theme-fusion.com/documentation-assets/avada/changelog.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}