CVE-2024-3806

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-380608.8Windows Imaging Component Remote Code Execution VulnerabilityCVE-2024-380617.5DCOM Remote Cross-Session Activation Elevation of Privilege VulnerabilityCVE-2024-380627.8Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityCVE-2024-380639.8Windows TCP/IP Remote Code Execution VulnerabilityCVE-2024-380647.5Windows TCP/IP Information Disclosure VulnerabilityCVE-2024-380656.8Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380667.8Windows Win32k Elevation of Privilege VulnerabilityCVE-2024-380677.5Windows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityCVE-2024-380687.5Windows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityCVE-2024-380697.0Windows Enroll Engine Security Feature Bypass VulnerabilityCVE-2024-38078.8The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortCVE-2024-380707.8Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
CVE-2024-3806: Critical severity, CVSS 9.8 | Vulnix