CVE-2024-3806

CRITICAL EXPLOITED RANSOMWARE

Porto theme for WordPress <7.1.0 - Local File Inclusion

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-3806 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. EIP tracks 1 public exploit from researchers including RandomRobbieBF.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2024-3806, demonstrating an unauthenticated Local File Inclusion (LFI) vulnerability in the Porto WordPress theme via the 'porto_ajax_posts' function. The PoC includes a crafted HTTP POST request that attempts to include the 'wp-config.php' file, though it currently results in a 500 error.

Description

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

Exploits (1)

nomisec WORKING POC
by RandomRobbieBF · remote
https://github.com/RandomRobbieBF/CVE-2024-3806

This repository contains a functional proof-of-concept for CVE-2024-3806, demonstrating an unauthenticated Local File Inclusion (LFI) vulnerability in the Porto WordPress theme via the 'porto_ajax_posts' function. The PoC includes a crafted HTTP POST request that attempts to include the 'wp-config.php' file, though it currently results in a 500 error.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Theoretical
Target: Porto WordPress theme <= 7.1.0
No auth needed
Prerequisites: WordPress with Porto theme <= 7.1.0 installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.6498
EPSS Percentile 98.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-03-19
Ransomware Use Confirmed
CWE
CWE-98
Status published
Products (1)
P-THEMES/Porto < 7.1.0
Published May 14, 2024
Tracked Since Feb 18, 2026