CVE-2024-11289 is a Local File Inclusion vulnerability in the Soledad WordPress theme (pencidesign) affecting all versions up to 8.5.9. It arises from improper control of filenames in include/require statements within functions such as penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This flaw allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to full code execution. The vulnerability is specifically exploitable on Windows platforms. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, which can result in bypassing access controls, unauthorized data access, and full remote code execution. The impact is high on confidentiality, integrity, and availability. Exploitability is limited to Windows environments. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor for updates from pencidesign or the theme vendor. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX functions or applying custom code-level mitigations to validate and sanitize input to prevent file inclusion. Avoid uploading PHP files to the server that could be included via this vulnerability.