CVE-2025-63067
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Porto Theme - Functionality plugin versions below 3.7.3 have a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to administrative functions or data, potentially leading to security breaches.
Recommendation
Update the plugin to version 3.7.3 or later and review permission configurations.
Other vulnerabilities in Porto Theme - Functionality
See all- CVE-2026-42415Critical
Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.
- CVE-2025-63066Medium
The Porto Theme - Functionality plugin (versions below 3.7.3) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Original NVD description (English source)
Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS