CVE-2026-39522: WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability

Synopsis

This is a Local File Inclusion (LFI) vulnerability in the WordPress Solene theme versions 3.4 and earlier. An unauthenticated attacker can reach the vulnerable endpoint over the network and supply a crafted file path to trick the server into loading arbitrary local files. Successful exploitation reads sensitive files from the server, tampers with application behavior, and can enable full remote code execution depending on available server-side files. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session token is required; the vulnerable code path is accessible to any anonymous HTTP request.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must overcome specific environmental conditions or timing factors, such as knowledge of file paths or server configuration, to succeed reliably.

Blast Radius

• A successful attacker reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• With database credentials in hand, the attacker can read or modify all data stored in the WordPress database, including user account records, session tokens, and site content.
• Depending on server configuration, the attacker can achieve remote code execution by including a file containing attacker-controlled content, giving full control over the web server process.
• All three impact dimensions (confidentiality, integrity, and availability) are rated High, so a complete compromise of the affected WordPress installation is within scope of exploitation.