The vulnerability is an unauthenticated SQL injection in the Porto Theme – Functionality plugin versions equal to or below 3.9.3. Because the plugin fails to properly validate or escape user‑supplied input, an attacker can inject arbitrary SQL statements. This flaw could allow the attacker to read, modify, or delete database records, potentially exposing sensitive user data or corrupting site content. Retrieving or altering the database also opens the door to downstream attacks such as credential theft and further exploitation of the compromised environment.

The affected product is the Porto Theme – Functionality plugin for WordPress, released by p‑themes. All installations using version 3.9.3 or earlier are vulnerable. Site owners running this plugin in any WordPress deployment must verify their plugin version.

The CVSS base score of 9.3 indicates critical severity. The exploit is unauthenticated and relies on normal web traffic, so an attacker can begin the attack from any external network without special credentials. The EPSS score of 0.247% indicates a low probability of exploitation in the wild, but the high severity and potential database compromise make this a high priority risk, even though it is not listed in the CISA KEV catalog. The attackers can craft a malicious SQL query to the vulnerable endpoint, bypass authentication, and execute arbitrary SQL commands against the WordPress database.