What is the CVSS score of CVE-2026-39522?

CVE-2026-39522 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Solene Theme are affected by CVE-2026-39522?

The Solene WordPress theme (versions 3.4 and earlier) contains an unauthenticated remote file inclusion vulnerability allowing attackers without credentials to read arbitrary files and potentially…

How to fix or mitigate CVE-2026-39522?

Within 24 hours: Audit all WordPress installations to identify use of Solene theme versions 3.4 or earlier. Within 7 days: Disable the Solene theme and migrate to an alternative theme, or monitor Elated Themes security advisories for a patched release. Within 30 days: Once a vendor patch is released, test immediately and deploy to all affected installations.

Solene Theme CVE-2026-39522

EUVD-2026-37472 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP WordPress Information Disclosure LFI Solene Wordpress Theme Elated Themes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects a non-trivial precondition for reliable inclusion, and CWE-98 plausibly enables full CIA impact via wp-config read and log-poisoning to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Solene WordPress theme versions 3.4 and earlier allows remote attackers to read arbitrary server-side files and potentially execute PHP code via improperly controlled filename inclusion (CWE-98). The flaw is reachable over the network without credentials, and while CVSS:3.1 rates it 8.1 (High) with high attack complexity, no public exploit identified at time of analysis. Wide impact is plausible because Solene is a commercial WordPress theme distributed by Elated Themes and exposed on internet-facing sites.

Technical ContextAI

The affected component is the Solene WordPress theme (cpe:2.3:a:elated-themes:solene), a PHP-based theme that renders pages through WordPress' theme engine. The root cause class is CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), meaning attacker-controlled input flows into a PHP include(), require(), include_once() or require_once() call without proper allow-listing or path canonicalization. In WordPress themes this pattern typically appears in template-loading helpers, AJAX endpoints, or shortcode handlers that accept a 'file', 'page', or 'template' parameter and concatenate it into an include path. Successful exploitation lets the attacker traverse the filesystem (e.g. wp-config.php) and, when log files or uploaded content can be reached, escalate to PHP code execution within the web server context.

RemediationAI

No vendor-released patch identified at time of analysis from the references provided; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/solene/vulnerability/wordpress-solene-theme-3-4-local-file-inclusion-vulnerability should be monitored for a fixed Solene release above 3.4, and operators should update to that version once published by Elated Themes via ThemeForest. In the interim, deploy the Patchstack or equivalent WordPress WAF virtual patch which specifically blocks LFI payloads against the Solene theme (trade-off: requires an active subscription and may need tuning to avoid false positives on legitimate template parameters), restrict access to theme PHP endpoints via web-server rules that reject requests containing '../', 'php://', 'file://', null bytes, or absolute paths in query parameters (trade-off: can break poorly-written plugins that legitimately pass paths), and harden PHP with open_basedir scoped to the WordPress docroot plus allow_url_include=Off and disable_functions including file wrappers where feasible (trade-off: may interfere with plugins that rely on remote includes or wrappers). As a last resort, temporarily switch to a different theme until a patched build is available.