CVE-2024-3809 Overview
CVE-2024-3809 is a Local File Inclusion (LFI) vulnerability in the Porto Theme - Functionality plugin for WordPress. The flaw affects all versions up to and including 3.0.9 and exists in the handling of the slideshow_type post meta value. Authenticated attackers with contributor-level permissions or higher can include and execute arbitrary files on the server. Successful exploitation allows execution of PHP code contained in any accessible file, enabling access control bypass, sensitive data disclosure, or full remote code execution when combined with a file upload primitive. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.
Critical Impact
Authenticated contributors can execute arbitrary PHP on the underlying server, leading to full site compromise.
Affected Products
- Porto Theme - Functionality plugin for WordPress
- All versions up to and including 3.0.9
- WordPress sites using the Porto Responsive WordPress + eCommerce Theme package
Discovery Timeline
- 2024-05-14 - CVE-2024-3809 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3809
Vulnerability Analysis
The Porto Theme - Functionality plugin fails to validate or sanitize the slideshow_type post meta value before passing it to a PHP file inclusion function. When the plugin renders a post or template, the meta value is used to build a file path that is loaded through PHP include or require semantics. Because the attacker controls the meta value, they can direct the include operation to arbitrary paths on the server filesystem.
Any PHP source encountered along that path executes in the context of the web server user. The vulnerability requires only contributor-level authentication, a low privilege tier that many WordPress sites grant openly to guest authors and community members. This makes the flaw practical to weaponize on multi-author sites.
Root Cause
The root cause is unsanitized user-controlled input flowing into a PHP file inclusion sink. The plugin trusts the slideshow_type post meta to reference a known template partial, but it applies no allowlist, canonicalization, or path traversal filtering. As a result, values containing directory traversal sequences or absolute paths resolve to attacker-chosen files.
Attack Vector
An authenticated user with contributor privileges creates or edits a post and sets the slideshow_type post meta to a crafted value pointing at a target file. When the affected rendering code runs, the plugin includes that file and executes any PHP within it. Attackers commonly chain LFI with a file upload primitive, log poisoning, or session file inclusion to achieve remote code execution. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-3809
Indicators of Compromise
- Unexpected slideshow_type post meta values in wp_postmeta containing ../, absolute paths, or non-standard identifiers.
- New or modified PHP files in wp-content/uploads/ or other writable directories, particularly following contributor account activity.
- Web server error log entries referencing failed include() or require() calls originating from the Porto Functionality plugin.
- Anomalous outbound network connections from the WordPress host after contributor logins.
Detection Strategies
- Query the WordPress database for post meta rows where meta_key = 'slideshow_type' and inspect values for path traversal patterns.
- Enable PHP open_basedir violation logging to surface include attempts outside the WordPress root.
- Correlate contributor logins with post edits and subsequent PHP process spawns of shells or system utilities.
Monitoring Recommendations
- Monitor filesystem changes to wp-content/plugins/ and wp-content/uploads/ for unexpected PHP files.
- Alert on wp-admin/post.php requests submitting slideshow_type values that contain slashes or dots.
- Track new contributor account registrations and role escalations in the WordPress audit log.
How to Mitigate CVE-2024-3809
Immediate Actions Required
- Update the Porto Theme - Functionality plugin to a version newer than 3.0.9 as soon as the vendor releases a fixed build.
- Audit all contributor and author accounts and remove any that are unused or unrecognized.
- Review wp_postmeta for suspicious slideshow_type values and delete or normalize them.
- Scan the webroot for unauthorized PHP files created after 2024-05-14.
Patch Information
Refer to the Wordfence Vulnerability Report and the Porto Theme product page for the latest patched version and vendor guidance. Update through the WordPress plugin manager once the fixed release is available from the theme author.
Workarounds
- Restrict contributor-level access until the plugin is patched; require editor review for post creation.
- Deploy a web application firewall rule that blocks POST requests containing slideshow_type parameters with ../, ..\, or absolute path prefixes.
- Configure PHP open_basedir to restrict include operations to the WordPress installation directory.
- Disable the Porto Theme - Functionality plugin if it is not essential to site operation.
# Configuration example: restrict PHP includes via open_basedir in php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
# WAF rule (ModSecurity) blocking traversal in slideshow_type
SecRule ARGS:slideshow_type "@rx (\.\./|\.\.\\|^/)" \
"id:1004809,phase:2,deny,status:403,msg:'CVE-2024-3809 LFI attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
