Skip to main content

Solene Theme CVE-2026-39522

| EUVDEUVD-2026-37472 HIGH
PHP Remote File Inclusion (CWE-98)
2026-06-16 Patchstack
PHP Information Disclosure LFI Solene
8.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects a non-trivial precondition for reliable inclusion, and CWE-98 plausibly enables full CIA impact via wp-config read and log-poisoning to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 16, 2026 - 23:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Solene WordPress theme versions 3.4 and earlier allows remote attackers to read arbitrary server-side files and potentially execute PHP code via improperly controlled filename inclusion (CWE-98). The flaw is reachable over the network without credentials, and while CVSS:3.1 rates it 8.1 (High) with high attack complexity, no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Fingerprint Solene theme on target
Delivery
Send crafted HTTP request to vulnerable include endpoint
Exploit
Bypass AC:H precondition with traversal or wrapper payload
Execution
PHP include() loads attacker-chosen file
Persist
Read wp-config.php or poisoned log
Impact
Execute PHP as web-server user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target site must be running the Solene WordPress theme at version 3.4 or earlier and have the vulnerable theme endpoint reachable over HTTP/HTTPS without authentication; exploitation does not require a logged-in WordPress user or any UI interaction (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, unauthenticated bug whose high impact across CIA is gated by AC:H - typically meaning a non-trivial precondition such as a specific parameter, encoding, or wrapper is required to win. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker enumerates WordPress sites running the Solene theme by fingerprinting /wp-content/themes/solene/style.css, then sends a crafted unauthenticated HTTP GET to the vulnerable theme endpoint with a path-traversal payload in the file/template parameter to read wp-config.php and harvest database credentials and AUTH_KEY secrets. If a writable log file or uploaded media path is reachable, the same primitive can be chained into PHP code execution by including a poisoned log entry, giving the attacker code execution as the web-server user. …
Remediation No vendor-released patch identified at time of analysis from the references provided; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/solene/vulnerability/wordpress-solene-theme-3-4-local-file-inclusion-vulnerability should be monitored for a fixed Solene release above 3.4, and operators should update to that version once published by Elated Themes via ThemeForest. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all WordPress installations to identify use of Solene theme versions 3.4 or earlier. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-98 – PHP Remote File Inclusion

View all
CVE-2023-3452 CRITICAL POC
9.8
CVE-2024-10571 CRITICAL POC
9.8
CVE-2012-10025 CRITICAL POC
10.0
CVE-2023-6989 CRITICAL POC
9.8
CVE-2024-3136 CRITICAL POC
9.8
CVE-2024-3806 CRITICAL
9.8
CVE-2023-5815 HIGH POC
8.1
CVE-2024-9193 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-39522 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy