CVE-2023-39922 is a Medium severity (CVSS 4.3) missing authorization flaw in the Avada theme for WordPress, up to and including version 7.11.1. Patchstack lists version 7.11.2 as the fix. Update to 7.11.2 or later, or remove the theme if you do not use it.
What's affected
Affected: the Avada theme from n/a through 7.11.1, per the record and Patchstack. Fixed: 7.11.2, according to Patchstack.
Severity: the record's CVSS 3.1 score is 4.3 (Medium). Patchstack's own priority view differs in tone: Patchstack rates priority Low and exploitation unlikely. Both can be true, since CVSS describes impact if exploited while priority reflects how likely exploitation is. The privilege needed is Subscriber.
How to check if you're exposed
From a shell on the server with WP-CLI installed:
wp theme list --fields=name,version,status | grep -i avada
In the WordPress admin, open Appearance, then Themes, and read the version in the theme details. If the version is 7.11.1 or lower, you are in the affected range. If the command finds nothing, the theme is not installed on that site. Check every site in a multisite network and every staging copy.
What to do now
- Update the Avada theme to 7.11.2 or later from your normal update channel.
- If you do not use the theme, deactivate and delete it rather than leaving it installed.
- Review accounts with elevated or contributor level roles and remove ones you do not recognize.
- Check logs and recent changes for actions you did not make, since a missing authorization flaw may leave little trace.
- Add the plugin and theme versions to your inventory so future advisories can be matched quickly.
Why it matters
The weakness is CWE-862 (missing authorization). In practice, a low privilege logged in user can reach actions or data they should not, such as other users data. The record does not give more detail than that, and I will not guess at specifics beyond what Patchstack publishes.
Broken access control is the most common class in WordPress plugin advisories. The code does what it was written to do, but it forgets to ask whether the caller is allowed. Fixes are usually small, which is why updating is cheap. NVD published this record on 2024-06-19, and the KEV flag is false, so there is no sign of exploitation from the sources checked.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
The privilege listed is: Subscriber. The CVSS vector in the record matches that.
Is it being exploited?
The record's KEV flag is false and Patchstack's page does not claim exploitation. Update anyway, because the fix is a normal version bump.
Sources
Last reviewed: 19 October 2026.
