What is the CVSS score of CVE-2025-68066?

CVE-2025-68066 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Soledad WordPress Theme are affected by CVE-2025-68066?

CVE-2025-68066 affects the PenciDesign Soledad WordPress theme through version 8.7.0, enabling authenticated users with low privileges to execute arbitrary PHP code through local file inclusion.

How to fix or mitigate CVE-2025-68066?

Within 24 hours: inventory all WordPress installations using PenciDesign Soledad theme and document current versions; disable theme if unused or restrict user access pending update. Within 7 days: contact PenciDesign for patch timeline and apply version 8.7.1 or later once released; if unavailable, implement file upload restrictions and reduce authenticated user accounts to necessity-only basis. Within 30 days: establish post-patch monitoring for suspicious PHP file inclusions in WordPress logs and conduct user privilege audit.

Soledad WordPress Theme CVE-2025-68066

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-16 audit@patchstack.com

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 20:30 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through <= 8.7.0.

AnalysisAI

Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.

Technical ContextAI

This vulnerability stems from improper validation of user-supplied input used in PHP include() or require() statements (CWE-98). WordPress themes commonly use dynamic file inclusion for template loading and plugin integrations. When user-controllable data is passed to these functions without adequate sanitization, attackers can manipulate the file path to reference arbitrary local files. Unlike remote file inclusion (RFI), which requires allow_url_include=On in PHP configuration, local file inclusion (LFI) works on default PHP installations. The vulnerability exists in the Soledad theme codebase, a commercial WordPress theme by PenciDesign used for magazine and blog sites. Successful exploitation depends on finding an input vector (query parameter, POST data, or authenticated admin function) that passes unsanitized data to a file inclusion function, combined with knowledge of server filesystem paths or use of path traversal techniques.

Affected ProductsAI

PenciDesign Soledad WordPress theme versions from unknown starting point through version 8.7.0. CPE data not provided in input. The vulnerability affects installations where the theme is active on WordPress sites. Vendor advisory available at Patchstack database: https://patchstack.com/database/Wordpress/Theme/soledad/vulnerability/wordpress-soledad-theme-8-7-0-local-file-inclusion-vulnerability. Specific WordPress core version dependencies not documented, but theme is designed for modern WordPress installations (likely 5.x-6.x range based on commercial theme development practices).

RemediationAI

Upgrade Soledad theme to version 8.7.1 or later if available. Check PenciDesign's official website or ThemeForest marketplace for the patched release. Patchstack disclosure at https://patchstack.com/database/Wordpress/Theme/soledad/vulnerability/wordpress-soledad-theme-8-7-0-local-file-inclusion-vulnerability confirms the issue but advisory does not specify exact fix version - verify current release notes from PenciDesign. If immediate patching is not feasible, implement compensating controls: restrict WordPress user roles to eliminate Subscriber and Contributor accounts (reducing PR:L attack surface to Administrators only), deploy web application firewall (WAF) rules to block common LFI patterns in query parameters (../, %2e%2e%2f, php://filter wrappers), enable PHP open_basedir restrictions to limit file access to WordPress installation directory and /tmp, and monitor access logs for suspicious file path manipulation attempts. These mitigations reduce but do not eliminate risk - they introduce administrative overhead (role management) and may cause false positives (WAF blocking legitimate requests). Theme replacement with alternatives should be considered if vendor does not release timely security updates.