CVE-2025-63067
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
Analysis
Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.
Technical Context
This is a missing authorization vulnerability (CWE-862: Improper Access Control) in the Porto Theme - Functionality WordPress plugin. The vulnerability stems from inadequate access control checks on protected functionality, allowing authenticated users with lower privilege levels to perform actions or access data normally restricted to higher-privilege roles. WordPress plugins implement role-based access control through the capabilities system; this plugin fails to properly verify the current user's capabilities before executing sensitive operations. The underlying issue is a logic flaw in authorization enforcement rather than a cryptographic or authentication weakness-valid sessions can bypass intended permission boundaries.
Affected Products
Porto Theme - Functionality plugin for WordPress is affected in all versions from the earliest tracked version through version 3.7.2, inclusive. The plugin is identified by CPE reference to the Patchstack WordPress plugin database entry. Vendor advisory and patch information is available at https://patchstack.com/database/Wordpress/Plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-3-6-2-broken-access-control-vulnerability?_s_id=cve.
Remediation
Vendor-released patch: Update Porto Theme - Functionality plugin to version 3.7.3 or later. Site administrators should navigate to the WordPress Plugins dashboard, locate Porto Theme - Functionality, and apply the available update immediately. No workarounds are documented; patching is the primary remediation path. For sites unable to update immediately, restrict plugin access to trusted administrators only and monitor audit logs for unauthorized access attempts. Detailed patch and advisory information is available at the Patchstack vulnerability database URL provided in the references.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today