The Soledad WordPress theme is vulnerable to a Local File Inclusion flaw through the 'header_layout' parameter. This issue allows authenticated users with Contributor-level access or higher to include arbitrary .php files present on the server, leading to the execution of any PHP code contained in those files. The vulnerability can be leveraged to bypass existing access controls, obtain sensitive data, or fully compromise the site if .php files can be uploaded and subsequently included. The weakness falls under CWE‑98, Local File Inclusion.

All installations of the Soledad theme from pencidesign, versions 8.6.7 and earlier, are affected. Users running these legacy versions of the theme on WordPress should review their current version and apply any available updates.

With a CVSS score of 8.8, the severity is High, but the EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with Contributor-level privileges to exploit the flaw, after which they can craft a request to the 'header_layout' parameter that points to a locally stored .php file. If such a file can be uploaded by the user, the attacker can execute arbitrary code, potentially leading to full site compromise.