CVE-2024-3806: Porto WordPress Theme RCE Vulnerability

CVE-2024-3806 Overview

The Porto theme for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 7.1.0. The flaw resides in the porto_ajax_posts function and allows unauthenticated attackers to include and execute arbitrary files on the server. Successful exploitation enables execution of arbitrary PHP code, bypass of access controls, and disclosure of sensitive data. In environments where attackers can upload PHP files through other means, this issue escalates to full remote code execution. The vulnerability is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement). The Porto theme is a widely distributed commercial WordPress theme sold through ThemeForest, increasing the population of exposed sites.

Critical Impact
Unauthenticated attackers can include arbitrary PHP files through the porto_ajax_posts AJAX handler, leading to remote code execution on affected WordPress installations.

Affected Products

Porto WordPress theme versions through 7.1.0
WordPress installations using the Porto theme on commerce and corporate sites
Sites bundling Porto with WooCommerce or related plugin ecosystems

Discovery Timeline

2024-05-14 - CVE-2024-3806 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-3806

Vulnerability Analysis

The vulnerability stems from improper validation of file path input within the porto_ajax_posts AJAX handler exposed by the Porto theme. The handler is reachable without authentication through the WordPress admin-ajax.php endpoint. Attacker-controlled input flows into a PHP include or require statement without canonicalization or allowlisting. PHP then loads and executes whatever file path resolves on the server filesystem, including local files outside the intended template directory. The flaw maps to CWE-98, reflecting unsafe filename handling in dynamic include statements.

Root Cause

The porto_ajax_posts function trusts a request parameter that influences which template or partial file is loaded. The theme passes that value into a PHP file inclusion sink without restricting the path to a known set of safe templates. Because PHP include executes any valid PHP code in the target file, the bug converts a path handling mistake into code execution. The handler also lacks a capability check or nonce verification, leaving it open to unauthenticated callers.

Attack Vector

An unauthenticated attacker sends a crafted POST or GET request to wp-admin/admin-ajax.php with action=porto_ajax_posts and a parameter pointing at the target file path. The attacker can reference local files such as configuration files containing database credentials, or a previously uploaded file with PHP content. When PHP loads attacker-controlled content, the code runs in the WordPress process context. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-3806

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php containing action=porto_ajax_posts from external IP addresses
Path traversal sequences such as ../ or absolute paths inside parameters of porto_ajax_posts requests
Unexpected PHP processes spawned by the web server user after Porto AJAX calls
New or modified PHP files in wp-content/uploads/ followed by inclusion attempts
Outbound connections from the web host to attacker infrastructure following theme AJAX activity

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with the porto_ajax_posts action and unusual file path parameters
Deploy WordPress-aware web application firewall rules that block path traversal patterns against AJAX endpoints
Correlate AJAX requests with file system changes in WordPress directories
Alert on PHP include/require calls referencing files outside the active theme directory through runtime application monitoring

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for query and retention
Track the version of the Porto theme across all hosted WordPress sites and flag instances at or below 7.1.0
Monitor for new administrative users, scheduled tasks, or plugin installations following suspicious AJAX activity

How to Mitigate CVE-2024-3806

Immediate Actions Required

Update the Porto theme to the version released after 7.1.0 that addresses CVE-2024-3806
Audit wp-content/uploads/ and theme directories for unauthorized PHP files
Rotate WordPress administrator credentials, database passwords, and any secrets stored in wp-config.php if compromise is suspected
Restrict access to admin-ajax.php from unexpected geographies or known malicious networks at the WAF layer

Patch Information

Upgrade the Porto theme to a version higher than 7.1.0. Consult the Wordfence Vulnerability Report for vendor patch details and the ThemeForest Product Overview for licensed update channels. Verify the patched version on every site using the theme, including staging and disaster recovery environments.

Workarounds

Disable the Porto theme until the patched version is installed and switch to a default WordPress theme
Block requests containing action=porto_ajax_posts at the WAF or reverse proxy if the AJAX endpoint is not required
Configure PHP open_basedir and disable_functions to limit file inclusion scope and reduce post-exploitation impact
Set strict file permissions on the WordPress filesystem to prevent web-writable PHP files in upload directories

bash

# Example WAF rule (ModSecurity) blocking the vulnerable action
SecRule ARGS:action "@streq porto_ajax_posts" \
    "id:1003806,phase:2,deny,status:403,\
    msg:'Block CVE-2024-3806 Porto LFI attempt',\
    chain"
    SecRule ARGS "@rx (\.\./|/etc/|\.php$)" "t:none"