CVE-2024-3809

HIGHRansomware

Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-3809 has a selected CVSS score of 8.8 (high). VulnCheck reports CVE-2024-3809 use in known ransomware campaigns.

Description

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 19, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 12, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Porto Theme - Functionality

Browse P-THEMES / Porto Theme - Functionality

Default status: unaffected

CVE ListThrough 3.0.9affected

Porto Theme for WordPress

Browse Porto / Porto Theme for WordPress
VulnCheckVersion data not supplied

functionality

Browse portotheme / functionality

Default status: unknown

CVE ListThrough 3.0.9affected

References

3