Unauthenticated SQL Injection in Porto Theme by WordPress
CVE-2026-42415

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Porto Theme - Functionality
Vendor
CVE Published:
6 October 2026

What is CVE-2026-42415?

Porto Theme, specifically in its functionality for versions up to 3.9.3, presents a critical vulnerability allowing attackers to exploit SQL injection without authentication. This flaw could enable unauthorized users to interact with the database, potentially leading to data exposure or manipulation. Website owners using this theme should take immediate action to secure their installations against imminent threats.

Affected Version(s)

Porto Theme - Functionality <= 3.9.3

References

https://patchstack.com/database/wordpress/plugin/porto-fu...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad | Patchstack Bug Bounty Program
.