CVE-2026-42415
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.
Risk Assessment
Potential for database takeover, data theft, or privilege escalation within the application.
Recommendation
Update Porto Theme - Functionality to a version that includes a security fix.
Other vulnerabilities in Porto Theme - Functionality
See all- CVE-2025-63067Medium
The Porto Theme - Functionality plugin versions below 3.7.3 have a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-63066Medium
The Porto Theme - Functionality plugin (versions below 3.7.3) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Original NVD description (English source)
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS