The Soledad WordPress theme contains a flaw that allows attackers to execute PHP code via the do_shortcode handler without proper validation. This weakness, identified as CWE‑94, enables the execution of arbitrary shortcodes, effectively giving an unauthenticated user the ability to run any PHP code that the shortcode mechanism accepts. The result can lead to full compromise of the affected website, including data theft, defacement, or installation of malicious components.

All installations of the Soledad theme with versions 8.6.7 or earlier are affected. The theme is provided by pencidesign under the product name Soledad. No explicit version roll‑up is supplied beyond the upper bound of 8.6.7.

The CVSS score of 7.3 indicates a high severity, and the EPSS score of less than 1% suggests that actual exploitation is unlikely at present, yet the vulnerability remains exploitable by unauthenticated users. It is not listed in the CISA KEV catalog. The attack vector is likely via a crafted request that triggers the do_shortcode function, relying on the theme’s lack of validation. An attacker does not need prior authentication to exploit the flaw, so the scope extends to any visitor of the affected site.