Porto Theme - Functionality: Unauthenticated SQL injection
Summary
The Porto Theme - Functionality WordPress plugin, version 3.9.3 and earlier, contains an unauthenticated SQL injection flaw. A remote attacker without an account can send crafted requests to read, modify or delete database content, including user accounts and customer data. Patchstack rates the issue as high priority and expects exploitation, but no fixed version is confirmed in the sources reviewed.
Affected
- Porto Theme - Functionality (WordPress plugin) versions up to and including 3.9.3
- Versions after 3.9.3: unknown
Fixed in
- Unknown. No fixed version number confirmed in the sources reviewed.
- The vendor's ThemeForest changelog lists a SQL injection fix, but without a version number.
Workaround
- Restrict access to the WordPress admin area.
- Deploy a Web Application Firewall with SQL injection blocking rules; whether a vendor or Patchstack virtual patch exists is unknown.
- Keep verified backups and review web and database logs for unusual query errors or unexpected database access.
Exploitation
- Known exploited: not known. KEV: No.
- Public proof of concept: not found in the searches performed.
- Patchstack states that the flaw is expected to be exploited in mass campaigns.
- The attack requires no authentication and low complexity.
Our recommendation
- Inventory all WordPress sites using Porto and record the Porto Functionality version on each.
- Update to the latest release from ThemeForest and confirm that the version is above 3.9.3 and includes the fix.
- If no fixed version is available, place a WAF or virtual patch in front of affected sites and monitor for SQL injection attempts.
- Check logs for signs of compromise and rotate credentials if anything looks suspicious.
- Recheck NVD and Patchstack for updates, as the NVD status is still Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-42415 patchstack.com
- Strix CVE-2026-42415 www.strix.ai
- HOL Guard CVE-2026-42415 hol.org
- TheHackerWire CVE-2026-42415 www.thehackerwire.com
- ThemeForest Porto changelog themeforest.net
- Wordfence Porto Functionality www.wordfence.com
- Patchstack article on Porto SQL injection patchstack.com
- Porto update plugins documentation www.portotheme.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:17.
Original description (NVD)
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.