PT-2026-133700

CVE-2026-115346

·

Publicado

2026-10-30

·

Atualizado

2026-10-30

Descrição por

CVSS 3.1
8.1
Alta
MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert palette images to truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Explorabilidade
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-434: Unrestricted Upload of File with Dangerous Type
Identificadores relacionados
CVE-2026-115346
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com