CVE-2026-39523: WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion is a vulnerability where an attacker can force a server-side application to read and expose files from the host filesystem, and in some configurations execute arbitrary code. The Solene Core WordPress plugin (versions 2.3.2 and below) is affected, reachable over the network with no authentication required, though exploitation requires meeting certain environmental or timing conditions reflected in the High attack complexity rating. Successful exploitation gives an attacker the ability to read sensitive server-side files, potentially modify data, or disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access to the host is needed.

• AuthenticationNot required

  No account or session credential is required; the vulnerable code path is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  No user action such as clicking a link or visiting a page is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific environmental conditions, configuration states, or timing factors to reliably trigger the file inclusion.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• Reads operating system files such as /etc/passwd, application logs, or private keys accessible to the web server process.
• In configurations where file inclusion can reach a writable or remotely controlled path, the attacker can achieve arbitrary code execution on the host.
• Full confidentiality, integrity, and availability of the affected WordPress instance and any data it can access are at risk.