Executive brief
The Solene theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive internal files. By exploiting this, an attacker could view configuration files containing database credentials or other private information, potentially leading to a full takeover of the website. This vulnerability affects all versions up to 3.4 and should be addressed immediately by updating to the latest version.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Solene WordPress theme (versions 3.4 and below) due to improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending crafted requests to include local files from the server. Successful exploitation can lead to the disclosure of sensitive information, such as wp-config.php, or potentially remote code execution if the attacker can upload or find a way to execute local files. The vulnerability is patched in version 3.4.1.
Affected products
- Elated-Themes Solene <= 3.4
Timeline
- 2026-02-02: other: Reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity)
- 2026-04-08: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD advisory published