CVE-2025-64188 (CVSS 9.8): Critical “Soledad” Theme Flaw Lets Subscribers Take Over WordPress Sites

CVE-2025-64188 (CVSS 9.8) is a critical vulnerability in the Soledad WordPress theme that could let a low‑level user take full control of a site. The flaw, detailed in a Patchstack advisory, affects all versions of the theme 8.6.9 and below, with the root cause identified as the penci_update_option AJAX action and its insufficient permission checks.

Although a nonce validation exists, the advisory notes that the action “does not check the user’s permissions or limit what options can be changed,” meaning any user able to access /wp-admin could exploit it. Exploitation could enable a Subscriber to alter settings such as users_can_register and default_role, enabling new accounts to be created as Administrators and potentially leading to a full site takeover, according to the advisory.

The developers have released a fix in version 8.6.9.1, adding a current_user_can permissions check to ensure only privileged users can use this AJAX action, and administrators are urged to update promptly. The article reports the disclosure on 12 December 2025. according to Patchstack.