The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 8.6.7. This vulnerability arises from the software allowing users to execute an action that does not properly validate a value before running do_shortcode. As a result, unauthenticated attackers can execute arbitrary shortcodes, potentially leading to further exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.3 | CVE-2025-8105 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the affected WordPress site, allowing them to execute arbitrary shortcodes without authentication. This can lead to unauthorized actions being performed on the site, potentially compromising its integrity and security.
Affected Products
- Soledad Theme (versions up to 8.6.7): A popular WordPress theme that allows users to create blogs and magazines, which is vulnerable to arbitrary shortcode execution.
Mitigation
To mitigate this vulnerability, users should update the Soledad theme to the latest version where the issue has been resolved. Additionally, implementing security measures such as input validation and restricting shortcode execution can help prevent exploitation.