CVE-2024-13693: Kriesi Enfold Auth Bypass Vulnerability

CVE-2024-13693 Overview

The Enfold theme for WordPress contains a missing capability check in avia-export-class.php that allows unauthenticated attackers to export all avia settings. The flaw affects all versions up to and including 6.0.9. Exported data may include sensitive secrets such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token when those integrations are configured. The weakness is classified under CWE-862: Missing Authorization and CWE-284: Improper Access Control.

Critical Impact

Unauthenticated remote attackers can retrieve plaintext API keys and secrets stored in theme settings, enabling account takeover against downstream services such as Mailchimp, reCAPTCHA, and Envato.

Affected Products

• Kriesi Enfold theme for WordPress, all versions through 6.0.9
• WordPress installations exposing the vulnerable avia-export-class.php endpoint
• Sites that have configured Mailchimp, reCAPTCHA, or Envato credentials within Enfold settings

Discovery Timeline

• 2025-02-25 - CVE-2024-13693 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13693

Vulnerability Analysis

The Enfold theme exposes an export routine implemented in avia-export-class.php. The handler serializes the full avia options array and returns it to the requester. The export action does not verify the caller's capability or role, so any HTTP client can trigger it. Because theme settings often store integration secrets in plaintext, a successful export can leak credentials with downstream impact beyond the WordPress site itself.

The attack requires no authentication, no user interaction, and only network access to the target site. The vulnerability affects confidentiality only; data integrity and site availability are not directly impacted. However, leaked credentials often enable follow-on attacks against the connected SaaS services, which can escalate the real-world impact well beyond the base score.

Root Cause

The export class omits a capability check such as current_user_can('manage_options') and does not validate a nonce before producing output. WordPress best practice requires both an authorization check and a request-origin check on administrative actions. Their absence allows unauthenticated invocation of a privileged function.

Attack Vector

An attacker issues an unauthenticated HTTP request to the Enfold export endpoint on a vulnerable site. The server responds with the serialized settings payload. The attacker parses the output for integration secrets and reuses them against Mailchimp, Google reCAPTCHA, or the Envato API. No code execution occurs on the WordPress host itself. For technical specifics on the vulnerable code path, refer to the Wordfence Vulnerability Update.

Detection Methods for CVE-2024-13693

Indicators of Compromise

• Unauthenticated HTTP requests to Enfold export endpoints invoking the avia export action in web access logs
• Outbound API activity against Mailchimp, reCAPTCHA, or Envato originating from unexpected IP addresses shortly after export requests
• Unknown source IPs retrieving large serialized responses from /wp-admin/admin-ajax.php or theme-specific endpoints referencing avia_export

Detection Strategies

• Inspect web server and WordPress logs for requests referencing avia_export, avia-export-class, or related action parameters from unauthenticated sessions
• Rotate and monitor Mailchimp, reCAPTCHA, and Envato credentials that were ever stored in Enfold settings on affected sites
• Use a web application firewall rule to flag or block anonymous POST and GET requests to the Enfold export handler

Monitoring Recommendations

• Alert on anomalous bursts of requests targeting WordPress theme AJAX actions from a single source
• Track outbound calls to third-party APIs using credentials associated with the WordPress site and correlate against expected usage patterns
• Enable WordPress audit logging to capture administrative actions and export operations, including caller identity and source IP

How to Mitigate CVE-2024-13693

Immediate Actions Required

• Upgrade the Enfold theme to a version later than 6.0.9 that includes the capability check fix, as noted in the Enfold Theme Changelog
• Rotate any Mailchimp API Key, reCAPTCHA Secret Key, Envato private token, or other third-party credential configured within Enfold settings
• Review web server logs for prior exploitation attempts and assume compromise of stored secrets if evidence is found

Patch Information

Kriesi has released an updated Enfold version addressing the missing capability check in avia-export-class.php. Site administrators should apply the update through the WordPress theme updater or by downloading the patched version from ThemeForest. Confirm the installed version is above 6.0.9 after the update completes.

Workarounds

• Deploy a web application firewall rule to block unauthenticated access to Enfold export endpoints until patching is complete
• Temporarily remove sensitive integration keys from Enfold settings and manage them through environment variables or a secrets manager where supported
• Restrict access to /wp-admin/ endpoints by IP allowlist at the reverse proxy or firewall layer to reduce exposure of theme AJAX handlers

# Example nginx rule to block unauthenticated access to the Enfold export action
if ($arg_action = "avia_ajax_export_buddypress") { return 403; }
if ($arg_action ~* "avia.*export") { return 403; }