CVE-2025-64188CWE-266

CVE-2025-64188

Critical · published December 18, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

🔥 A privilege escalation vulnerability in PenciDesign Soledad means unauthorized users could gain elevated access without breaking a sweat! Think of it like a restaurant where the kitchen staff can just wander into the VIP dining area without any checks — disaster waiting to happen! An attacker could leverage this flaw to gain full control over administrative capabilities, potentially altering settings, accessing sensitive data, or even locking out legitimate users. The consequences could be absolutely devastating for your website's integrity and user trust!

Put simply

Think of it like a restaurant where the kitchen staff can just wander into the VIP dining area without any checks — disaster waiting to happen! This vulnerability stems from incorrect privilege assignments, allowing users to perform actions they're not authorized for, bypassing expected security controls altogether.

What to do

An attacker could leverage this flaw to gain full control over administrative capabilities, potentially altering settings, accessing sensitive data, or even locking out legitimate users. The consequences could be absolutely devastating for your website's integrity and user trust! To protect your site, update PenciDesign Soledad to version 8.6.10 or later immediately. Review user roles and permissions to ensure no unauthorized access remains, and consider implementing additional user verification measures. 🛡️ You've got this! Stay vigilant and keep your site secure! 🚀

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-12-18T13:16Z
References (1)
EPSS history
Timeline
  • 18 DEC 07:22Z
    WordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability
    cvelistv5