CVE-2023-39307 is a high severity (CVSS 8.5) unrestricted file upload flaw in the ThemeFusion Avada theme for WordPress. It affects Avada through version 7.11.1. The Patchstack title describes it as an authenticated arbitrary file upload. Update to a release newer than 7.11.1 once you confirm the fixed version.
What's affected
The NVD record names one product: the ThemeFusion Avada theme for WordPress, versions through 7.11.1. The record scores it 8.5 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
The weakness class is CWE-434 (unrestricted upload of file with dangerous type). The vector asks for low privileges, which fits the Patchstack title that calls it an authenticated upload bug. Attack complexity is high, and the scope is changed.
The record gives no fixed version; it only says the issue affects the product from n/a through the stated version. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check which version of the Avada theme each WordPress site runs. With WP-CLI:
wp theme list --fields=name,status,version
wp plugin list --fields=name,status,version
You can also open Appearance, then Themes, or Plugins in the admin dashboard and read the version. Check staging and forgotten sites as well, since Avada is bundled with many purchased site templates. Then review the user list for accounts with author or higher rights that you do not recognise.
What to do now
- Inventory every site that uses Avada or Fusion Builder and note the installed versions.
- Look at the ThemeFusion release notes and the Patchstack entry for the first fixed version. The NVD record only says the issue affects versions through the stated release, so the fixed version has to be confirmed from the vendor.
- Update the theme and plugin together, since Avada and Fusion Builder ship as a pair, and test the sites after the update.
- Until you have updated, restrict which accounts can log in to WordPress, add multi factor authentication for them, and check the uploads folder for files that do not belong there.
- Review WordPress user accounts, remove unused ones, and keep author and editor rights to people who need them.
Why it matters
The flaw class is unrestricted upload of a file with a dangerous type. A site accepts a file from a user and does not check what kind of file it is, so a script can land on the server where the web server may run it. On WordPress that usually means code running with the site's own rights.
The vector needs a logged in account, so the first line of defence is account hygiene. The theme is installed on a very large number of sites, and file upload bugs in themes are a regular route for site takeovers. Keep the theme current and keep low privilege accounts to a minimum.
Quick check
Does an attacker need a login?
The vector asks for low privileges, and the Patchstack title calls it an authenticated upload, so yes.
What version fixes it?
The record does not say. It names versions through 7.11.1 as affected, so look for a release newer than that in the ThemeFusion notes and the Patchstack entry.
Sources
- Patchstack database entry (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description and the entry title in the URL)
- Safeguard Gold entry for CVE-2023-39307
Last reviewed: 19 October 2026.
