Introduction
Attackers with Contributor-level access can execute arbitrary PHP code on thousands of WordPress sites running the Soledad theme, which can lead to privilege escalation and potentially full compromise. CVE-2025-8142 affects all Soledad theme versions up to and including 8.6.7. Bloggers, publishers, and businesses use the theme widely for its flexibility and design options.
About Soledad and PenciDesign: Soledad is a premium multi-concept WordPress theme from PenciDesign, a vendor with a large presence on ThemeForest. Over 40,000 customers worldwide use the theme, across a wide range of content-heavy sites. PenciDesign has released several WordPress products, but Soledad is its flagship, so a vulnerability in this theme has an outsized effect on the WordPress ecosystem.
Technical Information
CVE-2025-8142 is a Local File Inclusion vulnerability caused by improper validation of the header_layout parameter in the Soledad WordPress theme. All versions up to and including 8.6.7 are affected. Any authenticated user with Contributor-level access or higher can pass an arbitrary file path for inclusion, and the server then executes any PHP code in that file.
The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The root cause is that the theme does not sanitize or restrict the header_layout parameter. An attacker can use this to:
- Include PHP files that already exist on the server
- Use directory traversal sequences to reach files outside the intended directory
- Execute uploaded PHP files if upload functionality is available or misconfigured
No public code snippets are available for this vulnerability. Exploitation requires Contributor-level authentication, but sites commonly grant that role to content creators and guest authors, so real-world exploitation is plausible.
Affected Systems and Versions
- Soledad WordPress theme, all versions up to and including 8.6.7
- Only WordPress installations with Contributor-level or higher authenticated users are vulnerable
- The flaw is in the theme, so it is present regardless of the WordPress core version
Vendor Security History
The Soledad theme has a documented history of vulnerabilities:
- CVE-2024-11289: Local File Inclusion in versions up to and including 8.5.9
- Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in earlier versions
- PenciDesign typically releases patches after disclosures, but similar issues have recurred, which points to gaps in its secure development practices
