CVE-2023-39313 is a high severity (CVSS 7.7) server side request forgery flaw in the ThemeFusion Avada theme for WordPress. It affects versions through 7.11.1. The Patchstack title says it needs authentication. The record names no fixed version, so confirm one with the vendor and update.
What's affected
The NVD record names one product: the ThemeFusion Avada theme for WordPress, versions through 7.11.1. The record scores it 7.7 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
The weakness class is CWE-918 (server side request forgery). The vector asks for low privileges and rates only confidentiality impact as high, with a changed scope.
The record gives no fixed version; it only says the issue affects the product from n/a through the stated version. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check which version of the Avada theme each WordPress site runs. With WP-CLI:
wp theme list --fields=name,status,version
wp plugin list --fields=name,status,version
You can also open Appearance, then Themes, or Plugins in the admin dashboard and read the version. Check staging and forgotten sites as well, since Avada is bundled with many purchased site templates. Then review the user list for accounts with author or higher rights that you do not recognise.
What to do now
- Inventory every site that uses Avada or Fusion Builder and note the installed versions.
- Look at the ThemeFusion release notes and the Patchstack entry for the first fixed version. The NVD record only says the issue affects versions through the stated release, so the fixed version has to be confirmed from the vendor.
- Update the theme and plugin together, since Avada and Fusion Builder ship as a pair, and test the sites after the update.
- If your hosting lets you, block the web server from reaching internal addresses and cloud metadata endpoints. That limits what a server side request can reach.
- Review WordPress user accounts, remove unused ones, and keep author and editor rights to people who need them.
Why it matters
Server side request forgery makes the web server send requests on behalf of an attacker. The server often sits inside a network that the attacker cannot reach directly, so it can read internal services or cloud metadata that are not meant to be public. The vector rates the confidentiality impact as high and leaves integrity and availability alone.
On hosted WordPress the reach may be small. On a site running in a cloud account with an instance role, it can be wider. Updating the theme is the main fix, and egress controls on the server are a good second layer.
Quick check
What can an SSRF flaw reach?
Anything the web server can reach, which may include internal services and cloud metadata. The exact reach depends on your hosting, so check it.
Do I need a login?
The vector asks for low privileges and the Patchstack title says authenticated.
Sources
- Patchstack database entry (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description and the entry title in the URL)
- Safeguard Gold entry for CVE-2023-39313
Last reviewed: 19 October 2026.
