CVE-2025-58922
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme. Allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. Affects versions before 7.13.2.
Risk Assessment
CSRF attack can lead to unauthorized changes in theme configuration or site content, potentially resulting in website integrity breach and loss of user trust.
Recommendation
Update Avada theme to version 7.13.2 or later and implement CSRF protection mechanisms.
Other vulnerabilities in Avada
See all- CVE-2026-18431Critical
The Avada theme for WordPress up to version 7.16 is vulnerable to Arbitrary File Write when the Fusion Builder plugin is installed and active in versions up to 3.16. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write attacker-controlled files to the server, leading to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder installed and active, as well as certain administrator-authored content.
- CVE-2026-12256High
Avada versions up to 3.15.3 are vulnerable to PHP Object Injection, potentially allowing unauthorized access to the system.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS