The Soleil WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to access or execute arbitrary files on the host server.

This vulnerability is a Local File Inclusion (CWE-98) flaw that occurs when user-supplied input is improperly handled in include or require statements. The vulnerability is accessible to unauthenticated attackers over the network.

Successful exploitation of this vulnerability allows an attacker to read sensitive files on the server or potentially achieve remote code execution, depending on the server configuration. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and significant operational downtime.

Immediate Action: As no specific patch version is currently confirmed, administrators should check the vendor website for the latest theme release and apply updates immediately. If an update is not available, consider switching to an alternative theme until a fix is provided.

Proactive Monitoring: Monitor server access logs for unusual patterns, such as directory traversal characters or attempts to access system files like wp-config.php or /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion requests.

Public Exploit Available: No.

This vulnerability presents a significant risk to the integrity and availability of the affected WordPress environment. Organizations using the Soleil theme should prioritize auditing their installations and implementing restrictive file system permissions as a temporary defense. Immediate action is required to monitor for indicators of compromise until a vendor-supplied update is verified and installed.