Avada Builder WordPress Plugin Unauthenticated Arbitrary Shortcode Execution Vulnerability

A vulnerability exists in the Avada Builder plugin for WordPress, allowing unauthenticated users to execute arbitrary shortcodes. This issue affects all versions of the plugin up to and including 3.11.13. The vulnerability arises because the plugin does not properly validate values before executing them with the do_shortcode function.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could lead to the execution of malicious code or actions on behalf of the user.

Remediation

Users can update to version 3.11.14 or a newer patched version to address this vulnerability.