CVE-2025-8105 is a code injection vulnerability in the Soledad WordPress theme by pencidesign. The theme improperly validates input before executing shortcodes via the do_shortcode function, enabling unauthenticated attackers to execute arbitrary shortcodes. This vulnerability affects all versions up to 8.6.7. The CVSS 3.1 score is 7.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

An attacker can execute arbitrary shortcodes without authentication, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected WordPress site. This could allow unauthorized actions within the site context depending on the shortcode capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting shortcode execution in the Soledad theme or applying temporary mitigations such as input validation or access controls if feasible.