CVE-2024-13346 is a high severity (CVSS 7.3) arbitrary shortcode execution flaw in the Avada website builder theme for WordPress and WooCommerce, in versions up to and including 7.11.13. Unauthenticated attackers can run shortcodes. Update past 7.11.13. Check the Avada changelog to confirm the release that closes it.
What's affected
- Avada theme, all versions up to and including 7.11.13.
The record does not name a fixed version. Confirm the release in the Avada changelog.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i avada
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the Avada theme and the Avada Builder plugin together.
- Confirm the new version in Appearance, then Themes, and in the Avada changelog.
- Remove unused plugins and themes that register shortcodes.
- Look up CVE-2024-13346 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
This is the theme half of a pair. CVE-2024-13345 describes the same flaw in the Avada Builder plugin, which is a separate package with its own version numbers. The record says an action does not validate a value before running do_shortcode.
If you update only one of the two, the other stays exposed. Check both versions after updating, because theme and plugin updates are often applied on different schedules.
This CVE is an arbitrary shortcode execution flaw (CWE-94, Code Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
WordPress shortcodes are small tags that expand into code-driven content. Running do_shortcode on a value that a visitor supplied means the visitor decides which shortcode runs, from every shortcode registered on the site.
The real impact depends on what is installed. Some shortcodes only print text. Others read data, query the database or change state. The weakness is classed as code injection because the input steers which code executes. The right fix is to validate the value against a fixed list before it reaches do_shortcode, and to avoid exposing the action to unauthenticated users at all.
Quick check
Is the plugin affected as well?
Yes. CVE-2024-13345 covers Avada Builder up to 3.11.13.
Is login required?
No. The record says unauthenticated attackers can exploit it.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
