CVE-2024-3807: Porto WordPress Theme RCE Vulnerability

CVE-2024-3807 Overview

The Porto theme for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 7.1.0. The flaw resides in the porto_page_header_shortcode_type, slideshow_type, and post_layout post meta parameters. Authenticated attackers with contributor-level or higher permissions can include and execute arbitrary files on the server. Successful exploitation allows execution of PHP code contained in included files, enabling access control bypass, sensitive data disclosure, or remote code execution when attackers can upload PHP files. The issue was partially patched in version 7.1.0 and fully patched in version 7.1.1.

Critical Impact

Authenticated contributors can achieve arbitrary PHP code execution on the WordPress server by abusing unsanitized post meta values in the Porto theme.

Affected Products

• Porto WordPress Theme versions up to and including 7.1.0
• Porto WordPress Theme version 7.1.0 (partial patch only)
• WordPress installations using the Porto responsive theme from ThemeForest

Discovery Timeline

• 2024-05-14 - CVE-2024-3807 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3807

Vulnerability Analysis

The vulnerability is classified as Local File Inclusion (LFI) and maps to [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). Attackers with contributor privileges can manipulate specific post meta fields that the theme uses to construct file paths for PHP include or require statements.

Because the theme trusts these post meta values without sufficient validation, an attacker can point them at arbitrary files on the server. Any PHP file referenced through these fields is executed within the WordPress process context.

The practical impact depends on what files an attacker can reference. Log files, uploaded media containing PHP payloads, or session files can all become code execution primitives. In environments where PHP file uploads are permitted, this vulnerability escalates directly to remote code execution.

Root Cause

The root cause is unsafe use of user-controllable post meta values as arguments to PHP file inclusion functions. The porto_page_header_shortcode_type, slideshow_type, and post_layout meta keys are writable by contributor-level users through standard WordPress post editing, yet the theme uses these values to determine which template files to load without a proper allowlist.

Attack Vector

An authenticated attacker with contributor permissions creates or edits a post and sets one of the vulnerable post meta values to a path pointing at an attacker-controlled or sensitive server file. When the affected page is rendered, the theme includes the referenced file and executes its PHP contents. The attack requires only low privileges, no user interaction, and can be performed remotely over the network.

The vulnerability mechanism is described in the Wordfence Vulnerability Report. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2024-3807

Indicators of Compromise

• Post meta entries with porto_page_header_shortcode_type, slideshow_type, or post_layout values containing path traversal sequences such as ../ or absolute file paths
• Unexpected PHP files in WordPress wp-content/uploads directories, particularly with recent modification times
• Web server logs showing contributor-level accounts editing posts followed by anomalous page renders
• Outbound network connections initiated by the PHP-FPM or web server process to unknown hosts

Detection Strategies

• Audit the wp_postmeta table for values in the three vulnerable meta keys that reference filesystem paths rather than expected template identifiers
• Monitor WordPress REST API and admin-ajax endpoints for post updates from contributor-level accounts that modify these specific meta fields
• Inspect web server access logs for requests to posts immediately after contributor-authored edits

Monitoring Recommendations

• Enable WordPress audit logging to track post meta changes by user role and correlate with subsequent page views
• Alert on new PHP file creation within wp-content/uploads and other writable web directories
• Track contributor and author account activity for signs of privilege abuse or lateral movement into other WordPress components

How to Mitigate CVE-2024-3807

Immediate Actions Required

• Update the Porto theme to version 7.1.1 or later, which contains the complete fix
• Review all contributor, author, and editor accounts and remove any that are unnecessary or suspicious
• Audit wp_postmeta for malicious values in porto_page_header_shortcode_type, slideshow_type, and post_layout
• Rotate WordPress secret keys and administrative credentials if compromise is suspected

Patch Information

The vendor released version 7.1.1 as the fully patched release. Version 7.1.0 contained only a partial fix and remains vulnerable. Site owners should obtain the current version through the ThemeForest Porto theme page and apply it across all affected WordPress installations.

Workarounds

• Restrict contributor-level and above accounts to trusted users only until patching is complete
• Configure the web server to deny PHP execution in wp-content/uploads and other user-writable directories
• Deploy a WordPress web application firewall rule that blocks path traversal patterns in post meta updates
• Disable the Porto theme temporarily and switch to a default WordPress theme if immediate patching is not feasible

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}