Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure

Vulnerability

The Avada (Fusion) Builder plugin for WordPress versions up to and including 3.11.12 suffers from an information exposure vulnerability. The handle_clone_post() function and the fusion_blog shortcode lack sufficient restrictions on which posts can be included, allowing exposure of password-protected, private, or draft posts that should be restricted.

Exploitation

An authenticated attacker with contributor-level access or above can exploit this by crafting requests to the handle_clone_post() function or using the fusion_blog shortcode to enumerate and extract content from posts that are not intended to be accessible to them.

Impact

The attacker gains unauthorized read access to password-protected, private, or draft posts, leading to information disclosure of sensitive content that may include unpublished or confidential data.

Mitigation

The vendor (Avada) has not yet released a patch for this vulnerability as of the publication date. Users should monitor the vendor's website [1] for updates and consider restricting contributor-level access or disabling the vulnerable shortcode temporarily. No workaround is currently available.