Porto Theme Functionality CVE-2026-42415

No authentication required (CVSS PR:N) - exploitable by remote unauthenticated attackers against any WordPress site with the Porto Theme Functionality plugin version 3.9.3 or earlier installed and active. The only practical prerequisite is that the vulnerable plugin is present and its affected endpoint is reachable over the network; no user interaction, special privileges, or non-default configuration is indicated by the description or vector. The primary limiting factor is simply upgrading past the vulnerable 3.9.3 build; the exact feature/parameter carrying the injection is not specified in the available data, so defenders cannot scope it to a single feature toggle.

This is a genuine priority for WordPress sites running the Porto theme's companion plugin, though several high-value signals are missing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-practical combination for a web vulnerability - remote, low-complexity, unauthenticated, no user interaction - which aligns with the 'Unauthenticated SQL Injection' description and CWE-89, so the core signals are internally consistent. The 9.3 score is driven partly by the S:C (scope-changed) and A:L metrics chosen by Patchstack; the C:H/I:N confidentiality-dominant impact matches a data-disclosure SQLi, though I:N is slightly surprising for SQL injection and I treat it as conservative rather than authoritative. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is 'no public exploit identified at time of analysis' - the elevated risk here is structural (trivial-to-exploit unauthenticated SQLi in a widely-sold theme) rather than evidenced by observed exploitation. Unauthenticated SQLi flaws in popular WordPress ecosystem components are historically attractive for automated mass-scanning, so despite the absence of EPSS/KEV data the real-world risk should be treated as high and patched promptly.

A remote attacker, without any account or credentials, sends a crafted HTTP request to a vulnerable endpoint exposed by the Porto Theme Functionality plugin (<= 3.9.3), injecting SQL through an unsanitized parameter. The injected query is executed against the WordPress database, allowing extraction of sensitive data such as user credentials, password hashes, and secret keys. No public exploit code was identified in the provided data, but the AV:N/AC:L/PR:N/UI:N profile means weaponization would be straightforward.