Arbitrary File Inclusion Vulnerability in Porto Theme's Portfolio Layout Attribute

CVE-2024-3808

Summary

The Porto Theme - Functionality plugin for WordPress is affected by a Local File Inclusion vulnerability, allowing authenticated attackers with contributor-level and higher permissions to include and execute arbitrary files on the server. This vulnerability arises through the 'porto_portfolios' shortcode's 'portfolio_layout' attribute, which can be manipulated to bypass access controls. Exploitation of this vulnerability could lead to the execution of PHP code contained in uploaded files, potentially compromising sensitive data and server integrity.

References