The vulnerability is an improper control of filename for include/require in PenciDesign Soledad, allowing attackers to craft a path that resolves to an arbitrary local file. Because the theme performs a PHP include with insufficient validation, an attacker could read sensitive files such as configuration or password files, or potentially execute code if a writable file is included. The weakness is classified as CWE‑98.

This issue affects the WordPress Soledad theme by PenciDesign version 8.6.8 and earlier. Sites that are running any of those versions of the theme are vulnerable; no other products are impacted.

The CVSS score of 7.5 indicates a high severity and the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but because the flaw permits local file inclusion potentially from a remote crafted request, it could be abused by an attacker with network access to the WordPress administration or front‑end. The attack vector is inferred to be remote through a crafted URL if the theme’s include is triggered by a request parameter.