CVE-2024-11289

The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This makes it possible for unauthenticated attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. The exploitability of this is limited to Windows.

• CWE-98

• https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398
• https://www.wordfence.com/threat-intel/vulnerabilities/id/927674db-05f1-4f3b-8297-8a907955ea87?source=cve

Published

Dec 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11283The WP JobHunt plugin for WordPress is vulnerable to authent…7.5
• CVE-2024-11284The WP JobHunt plugin for WordPress is vulnerable to privile…9.8
• CVE-2024-11285The WP JobHunt plugin for WordPress is vulnerable to privile…9.8
• CVE-2024-11286The WP JobHunt plugin for WordPress is vulnerable to authent…9.8
• CVE-2024-11287The Ebook Store plugin for WordPress is vulnerable to Reflec…6.1
• CVE-2024-11288Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-1129The NEX-Forms – Ultimate Form Builder – Contact forms and mu…4.3
• CVE-2024-11290The Member Access plugin for WordPress is vulnerable to Sens…5.3
• CVE-2024-11291The Paid Membership Subscriptions – Effortless Memberships, …5.3
• CVE-2024-11292The WP Private Content Plus plugin for WordPress is vulnerab…5.3
• CVE-2024-11293The Registration Forms – User Registration Forms, Invitatio…8.1
• CVE-2024-11294The Memberful plugin for WordPress is vulnerable to Sensitiv…5.3