CVE-2025-8142

High

Published: 16 August 2025

Published

16 August 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0017 38.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8142 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-8142 is a Local File Inclusion vulnerability (CWE-98) affecting the Soledad theme for WordPress in all versions up to and including 8.6.7. The flaw exists in the handling of the 'header_layout' parameter, which enables the inclusion and execution of arbitrary .php files on the server. Published on 2025-08-16, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of PHP code from included files, potentially bypassing access controls, obtaining sensitive data, or achieving code execution, especially in scenarios where .php files can be uploaded.

Advisories and patch information are detailed in the Soledad theme's update changelog on ThemeForest and Wordfence's threat intelligence report.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-28792

Vulnerability details

The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'header_layout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary…

.php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

LFI in public-facing WordPress theme directly enables exploitation via T1190; arbitrary PHP file inclusion/execution facilitates web shell deployment under T1505.003.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1