CVE-2024-3809

The Porto Theme - Functionality plugin through version 3.0.9 contains a local file inclusion vulnerability in the slideshow_type post meta parameter that allows authenticated users with contributor privileges or higher to load and run arbitrary files from the server. An attacker could exploit this flaw to execute arbitrary PHP code, potentially bypassing access restrictions, stealing sensitive information, or running malicious code if a PHP file has been uploaded to the system.

Based on public CVE data (MITRE/NVD).