What is the CVSS score of CVE-2026-39523?

CVE-2026-39523 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Solene Core are affected by CVE-2026-39523?

Solene Core WordPress plugin versions 2.3.2 and earlier create a material operational security risk by allowing unauthenticated remote attackers to execute arbitrary code on affected servers.

How to fix or mitigate CVE-2026-39523?

Within 24 hours: Inventory all WordPress instances running Solene Core plugin version 2.3.2 or earlier and disable the plugin immediately to prevent exploitation. Within 7 days: Evaluate alternative plugins or WordPress core alternatives; implement Web Application Firewall rules to block suspicious file inclusion patterns if plugin removal is not immediately feasible. Within 30 days: If the plugin remains in use, migrate to an alternative solution; verify remediation completion across all WordPress instances.

Solene Core CVE-2026-39523

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Solene Core

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress endpoint with no auth or user interaction (AV:N/PR:N/UI:N); AC:H reflects needing the right parameter and file path; LFI-to-PHP-execution justifies C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:36 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Solene Core WordPress plugin (versions <= 2.3.2) by elated-themes allows remote attackers to include and execute arbitrary local PHP files on the server without authentication. The CVSS 8.1 rating reflects full confidentiality, integrity, and availability impact, though high attack complexity suggests non-trivial exploitation prerequisites. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Solene Core is a companion plugin tied to the commercial 'Solene' WordPress theme published by elated-themes (CPE cpe:2.3:a:elated-themes:solene_core:*). The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning the plugin passes attacker-controllable input into a PHP include()/require() construct without sufficient sanitization or whitelisting. This typically arises when a parameter (e.g., a 'template', 'page', or 'file' GET/POST value) is concatenated into an include path, allowing path traversal sequences or absolute paths to reach sensitive PHP files within the WordPress installation. Because PHP include directives execute the included file as code, the impact can extend beyond simple file disclosure to arbitrary code execution if the attacker can plant or reach an attacker-controlled PHP file (e.g., via log poisoning, uploaded media, or session files).

RemediationAI

No vendor-released patch identified at time of analysis based on the provided input; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/solene-core/vulnerability/wordpress-solene-core-plugin-2-3-2-local-file-inclusion-vulnerability) should be consulted for any updated fix version released by elated-themes. Until a fixed release is available, administrators should deactivate and remove the Solene Core plugin (note: this will disable theme features that depend on it, potentially breaking site functionality), or place the WordPress installation behind a WAF with virtual patching such as Patchstack or Wordfence to block path-traversal and LFI patterns in request parameters. Compensating controls include configuring PHP with open_basedir restrictions to limit which files can be included (may break legitimate plugins that read outside the webroot), disabling allow_url_include in php.ini, and restricting web server access to the plugin's entry points via .htaccess or Nginx location rules until the vendor publishes a patched version.