Porto Theme Vulnerable to Local File Inclusion Attacks

CVE-2024-3806

Summary

The Porto Theme for WordPress is susceptible to a Local File Inclusion (LFI) vulnerability that affects all versions up to and including 7.1.0. The vulnerability is rooted in the 'porto_ajax_posts' function, which allows unauthenticated attackers to manipulate the inclusion of server files. This exploitation can lead to the execution of arbitrary PHP code included in those files, thereby bypassing standard access controls. Attackers can potentially access sensitive information or execute malicious code on the server by leveraging this flaw, especially in situations where PHP files can be uploaded and included.

References