CVE-2024-13693
📋 TL;DR
The Enfold WordPress theme has an authorization bypass vulnerability that allows unauthenticated attackers to export all theme settings. This can expose sensitive API keys and tokens stored in the theme configuration. All WordPress sites using Enfold theme versions up to 6.0.9 are affected.
💻 Affected Systems
- Enfold WordPress Theme
📦 What is this software?
Enfold by Kriesi
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain Mailchimp API keys, reCAPTCHA secrets, Envato tokens, and other sensitive credentials, leading to account compromise, spam campaigns, or unauthorized access to third-party services.
Likely Case
Attackers harvest API keys and tokens for credential stuffing, account takeover, or selling on dark web markets.
If Mitigated
No sensitive data exposure if no API keys were configured in Enfold settings, though attackers could still map site configuration.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.0 or later
Vendor Advisory: https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990#item-description__changelog
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Click 'Update Now' on Enfold theme. 4. Verify theme version is 6.1.0 or higher.
🔧 Temporary Workarounds
Disable Enfold Export Functionality
linuxRemove or rename the vulnerable avia-export-class.php file to prevent exploitation.
mv /path/to/wp-content/themes/enfold/avia-export-class.php /path/to/wp-content/themes/enfold/avia-export-class.php.disabled
🧯 If You Can't Patch
- Remove all sensitive API keys from Enfold theme settings immediately
- Implement web application firewall (WAF) rules to block requests to /wp-content/themes/enfold/avia-export-class.php
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes > Enfold details for version number. If version is 6.0.9 or lower, site is vulnerable.Check Version:
grep -r 'Version:' /path/to/wp-content/themes/enfold/style.cssVerify Fix Applied:
Confirm theme version is 6.1.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /wp-content/themes/enfold/avia-export-class.php
- Unusual export requests from unauthenticated users
Network Indicators:
- Outbound connections to Mailchimp/Envato/reCAPTCHA APIs from unexpected sources
SIEM Query:
source="web_server" AND (uri_path="/wp-content/themes/enfold/avia-export-class.php" OR user_agent="*" AND status_code=200)