CVE-2026-42415

p-themes Porto Theme - Functionality

Published 6 Oct 2026 · updated 6 Oct 2026 · Deferred

9.3 Critical · CVSS 3.1, patchstack.com

Description

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

References

patchstack.com/database/wordpress/plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-3-9-3-sql-injection-vulnerability?_s_id=cve