PT-2025-33591 · WordPress · Soledad

Matthew Rollings · Published 2025-08-16 · Updated 2025-08-21 · CVE-2025-8142

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Soledad theme for WordPress versions through 8.6.7

Description: The Soledad theme for WordPress is susceptible to a Local File Inclusion issue via the header layout parameter. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary .php files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted.

Recommendations: Versions prior to 8.6.7 should be updated. As a temporary workaround, restrict access to the header layout parameter to prevent unauthorized file inclusion.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-8142

Affected Products

Soledad

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8142 · Security Note
• https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398#item-description__update-changelog · Note
• https://twitter.com/cracbot/status/1958484278775263501 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7dea9b4a-d7a5-4ea7-b55f-b42f8f5c4a91?source=cve · Note
• https://twitter.com/CveFindCom/status/1956682467160515048 · Twitter Post
• https://t.me/CVEtracker/30227 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1956757941916234171 · Twitter Post
• https://twitter.com/CVEnew/status/1956766339399397498 · Twitter Post