CVE-2024-13695: The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated atta

medium Affects enfold (WordPress theme). Feed 2026.10.29.1, updated 2026-10-28; published 2025-02-25; advisory modified 2026-06-17.

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated atta

Package: enfold (WordPress theme) WordPress
Affected versions: <7.0.0
Fixed in: 7.0.0
Severity: medium CVSS 6.4
Exploitation: not on CISA KEV · EPSS 0% (17.2th percentile)
Published: 2025-02-25
Source: nvd

References

CWE-918

NVD record enfold (WordPress theme) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2014-7297 high Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for Wor same package: enfold (WordPress theme)
CVE-2024-13693 medium The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missi same package: enfold (WordPress theme)
CVE-2024-5061 medium The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cr same package: enfold (WordPress theme)
CVE-2021-21311 KEV high SSRF in adminer same weakness: CWE-918
CVE-2022-1386 critical The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not valida same weakness: CWE-918
CVE-2021-32682 critical elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE same weakness: CWE-918