Arbitrary File Inclusion Vulnerability in Porto Theme's Portfolio Layout Attribute

CVE-2024-3808

What is CVE-2024-3808?

The Porto Theme - Functionality plugin for WordPress is affected by a Local File Inclusion vulnerability, allowing authenticated attackers with contributor-level and higher permissions to include and execute arbitrary files on the server. This vulnerability arises through the 'porto_portfolios' shortcode's 'portfolio_layout' attribute, which can be manipulated to bypass access controls. Exploitation of this vulnerability could lead to the execution of PHP code contained in uploaded files, potentially compromising sensitive data and server integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References