First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-42415

CriticalCVSS 9.3/10Last modified Oct 6, 2026

Description

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
p-themes	Porto Theme - Functionality	<= 3.9.3

References

https://patchstack.com/database/wordpress/plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-3-9-3-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Oct 6, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-424168.5Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.CVE-2026-424179.3Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.CVE-2026-424187.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rock CVE-2026-424195.9Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.CVE-2026-42422.5A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of th CVE-2026-424206.5OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits CVE-2026-424215.4OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation CVE-2026-424228.8OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved CVE-2026-424237.5OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on ga CVE-2026-424245.0OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltr CVE-2026-424257.2OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL s CVE-2026-424268.8OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope in