CVE-2023-39312 is a critical severity (CVSS 9.1) missing authorization flaw in the ThemeFusion Avada theme for WordPress. It affects Avada through 7.11.1. The Patchstack title describes unrestricted zip extraction by an author level user. The record names no fixed version, so check the vendor and update.
What's affected
The NVD record names one product: the ThemeFusion Avada theme for WordPress, versions through 7.11.1. The record scores it 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
The weakness class is CWE-862 (missing authorization). The vector and the Patchstack title do not match exactly. The vector asks for high privileges, while the URL title says an authenticated author can do it. An author is a low privilege WordPress role, so we flag both and suggest you read the advisory before judging your own risk.
The record also rates confidentiality, integrity and availability impact as high, and the scope as changed.
The record gives no fixed version; it only says the issue affects the product from n/a through the stated version. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check which version of the Avada theme each WordPress site runs. With WP-CLI:
wp theme list --fields=name,status,version
wp plugin list --fields=name,status,version
You can also open Appearance, then Themes, or Plugins in the admin dashboard and read the version. Check staging and forgotten sites as well, since Avada is bundled with many purchased site templates. Then review the user list for accounts with author or higher rights that you do not recognise.
What to do now
- Inventory every site that uses Avada or Fusion Builder and note the installed versions.
- Look at the ThemeFusion release notes and the Patchstack entry for the first fixed version. The NVD record only says the issue affects versions through the stated release, so the fixed version has to be confirmed from the vendor.
- Update the theme and plugin together, since Avada and Fusion Builder ship as a pair, and test the sites after the update.
- Until the update is in, list every account with author rights or above, remove those that are not needed, and watch the uploads and theme folders for new files.
- Review WordPress user accounts, remove unused ones, and keep author and editor rights to people who need them.
Why it matters
Missing authorization means a function checks that you are logged in but not whether your role allows what you are asking for. The Patchstack title says an author can extract a zip file without restriction. Extracting an archive can place files anywhere the web process can write, and on WordPress that can include executable code.
This is the highest scored entry in the Avada group. The author role is often given to guest writers and agency staff, so the number of accounts that qualify can be larger than people expect. If your sites have such accounts, treat this as a priority patch. If not, the score is still high enough to schedule within the week.
Quick check
Is this really critical if an account is needed?
The record scores it 9.1 with a high privilege requirement in the vector, and the title in the Patchstack URL says author level. Read both and judge from the roles on your sites.
What version fixes it?
The record does not name one. It says versions through 7.11.1 are affected.
Sources
- Patchstack database entry (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description and the entry title in the URL)
- Safeguard Gold entry for CVE-2023-39312
Last reviewed: 19 October 2026.
