The vulnerability CVE-2025-59588 in PenciDesign Soledad theme arises from improper validation or control of filenames used in PHP include or require statements. This allows a local file inclusion attack, where an attacker can cause the application to load unintended local files. The issue affects Soledad versions up to 8.6.8. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation details are currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The attacker requires low privileges but must overcome high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of PenciDesign Soledad theme should monitor vendor communications for updates. Until a fix is available, consider restricting access to vulnerable components and applying web application firewall rules to detect and block suspicious include/require requests if feasible.