CVE-2025-8142: Soledad WordPress Theme RCE Vulnerability

CVE-2025-8142 Overview

CVE-2025-8142 is a Local File Inclusion (LFI) vulnerability in the Soledad theme for WordPress affecting all versions up to and including 8.6.7. The flaw resides in the handling of the header_layout parameter, which fails to properly validate user-supplied input before passing it to a PHP include function. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation allows attackers to bypass access controls, read sensitive files, and achieve remote code execution when combined with file upload functionality. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact

Authenticated attackers with Contributor privileges can execute arbitrary PHP code on the server, leading to full site compromise.

Affected Products

• Soledad theme for WordPress — all versions up to and including 8.6.7
• WordPress installations using the Soledad multi-concept blog/magazine theme
• Sites permitting Contributor-level registration or higher

Discovery Timeline

• 2025-08-16 - CVE-2025-8142 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-8142

Vulnerability Analysis

The Soledad theme processes the header_layout parameter and uses its value to construct a file path passed to a PHP include or require statement. The theme does not sanitize, normalize, or validate this input against an allowlist of permitted layout files. Attackers can supply traversal sequences or arbitrary file paths to load any .php file accessible on the server filesystem.

Once an arbitrary PHP file is included, its contents execute in the context of the WordPress process. This grants attackers the same privileges as the web server user. Common post-exploitation paths include reading wp-config.php credentials, harvesting database contents, and chaining with media uploads to drop a webshell.

The attack requires authentication at the Contributor role or above. WordPress sites that permit open user registration or low-trust contributor accounts present the broadest attack surface.

Root Cause

The root cause is improper control of a filename used in a dynamic include or require statement [CWE-98]. The header_layout parameter flows directly into a file path concatenation without an allowlist check or path canonicalization. PHP's filesystem functions resolve traversal sequences such as ../, allowing reference to files outside the intended theme directory.

Attack Vector

The vulnerability is exploitable over the network through standard HTTP(S) requests to WordPress endpoints that process the header_layout parameter. An attacker authenticates as a Contributor, then submits a crafted request specifying a path to an arbitrary .php file. If the attacker can upload files (for example, through media uploads with weak MIME filtering or by abusing other plugins), they can stage a .php payload and reference it through the LFI to achieve remote code execution. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8142

Indicators of Compromise

• HTTP requests containing the header_layout parameter with path traversal sequences such as ../ or absolute filesystem paths
• Unexpected .php files appearing in the wp-content/uploads/ directory
• New or modified administrator accounts in wp_users not created by legitimate administrators
• Outbound network connections originating from the PHP-FPM or web server process to unfamiliar hosts

Detection Strategies

• Inspect web server access logs for requests referencing header_layout with values that do not match expected theme layout names
• Deploy WordPress-aware web application firewall rules that block path traversal characters in theme parameters
• Monitor PHP error logs for include() or require() failures referencing unusual file paths
• File integrity monitoring on the wp-content/themes/Soledad/ directory and uploads folder

Monitoring Recommendations

• Alert on Contributor or Author accounts performing actions that produce file inclusion requests
• Baseline normal header_layout values and trigger alerts on deviations
• Track creation of .php files outside of plugin and theme installation events

How to Mitigate CVE-2025-8142

Immediate Actions Required

• Update the Soledad theme to a version later than 8.6.7 that addresses the LFI flaw
• Audit all Contributor, Author, and Editor accounts and remove any that are unrecognized or inactive
• Disable open user registration on sites that do not require it
• Review the wp-content/uploads/ directory for unauthorized .php files and remove them

Patch Information

The theme vendor publishes updates and changelog entries on the ThemeForest Soledad item page. Site administrators should apply the latest theme update via the WordPress administrator dashboard or by replacing the theme files manually. Verify the installed version after update by inspecting the theme's style.css header.

Workarounds

• Restrict Contributor-level account creation and require manual approval for new accounts
• Configure the web server to deny execution of .php files within the wp-content/uploads/ directory
• Deploy a WordPress firewall rule to block requests where header_layout contains ../, null bytes, or absolute paths
• Apply PHP open_basedir restrictions to limit which directories the PHP process can read

# Apache: prevent PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}