CVE-2024-13345: High Shortcode Execution in Avada Builder

CVE-2024-13345 is a high severity (CVSS 7.3) arbitrary shortcode execution flaw in the Avada Builder plugin for WordPress, in versions up to and including 3.11.13. Unauthenticated attackers can run shortcodes. Update past 3.11.13 using the Avada changelog to confirm the fix.

What's affected

• Avada Builder (Fusion Builder), all versions up to and including 3.11.13.

The record does not name a fixed version. Avada publishes a changelog, which is the place to confirm the release that closes it.

How to check if you're exposed

Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.

wp plugin list --format=table | grep -i fusion

Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.

What to do now

1. Update Avada Builder, and update the Avada theme at the same time, since CVE-2024-13346 covers the theme.
2. Check the Avada changelog to confirm the release you install addresses the issue.
3. List the shortcodes registered on your site, and remove plugins you do not use.
4. Look up CVE-2024-13345 on its Gold page to see the current details and any fix information.
5. Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.

Why it matters

The record says an action does not validate a value before running do_shortcode. The effect depends on what other shortcodes your site has, which is why a plugin audit is part of the response. The vector rates impacts low across the board, but the attack needs no account.

Avada ships as a theme and a companion builder plugin, and each carries its own CVE for the same flaw. Update both.

This CVE is an arbitrary shortcode execution flaw (CWE-94, Code Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.

WordPress shortcodes are small tags that expand into code-driven content. Running do_shortcode on a value that a visitor supplied means the visitor decides which shortcode runs, from every shortcode registered on the site.

The real impact depends on what is installed. Some shortcodes only print text. Others read data, query the database or change state. The weakness is classed as code injection because the input steers which code executes. The right fix is to validate the value against a fixed list before it reaches do_shortcode, and to avoid exposing the action to unauthenticated users at all.

Quick check

Sources

• Avada changelog
• Wordfence advisory

Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.

Last reviewed: 19 October 2026.