CVE-2026-13250
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Solace Extra plugin for WordPress up to version 1.5.3 is vulnerable to authorization bypass. Unauthenticated attackers can permanently delete all content previously imported via the Starter Template feature, including posts, pages, media, WooCommerce products, taxonomy terms, and templates. The required nonce is exposed on every admin page, and the handler is also registered for unauthenticated users.
Risk Assessment
The risk is that an attacker with no privileges can completely delete critical site content, leading to data loss and service disruption.
Recommendation
Immediately update the Solace Extra plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Other vulnerabilities in Solace Extra
See all- CVE-2026-18316Critical
The Solace Extra plugin for WordPress up to version 1.6.0 is vulnerable to unauthorized modification and data loss due to a missing capability check in the import_zip() function. The function is accessible to any authenticated user, including subscribers, and can wipe navigation menus, widgets, theme mods, and Elementor templates.
- CVE-2026-27535High
The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.
Original NVD description (English source)
The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all content previously imported via the Starter Template feature, including posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. The required nonce is emitted on every wp-admin page via wp_localize_script() hooked to admin_enqueue_scripts without a page guard, meaning any Subscriber visiting /wp-admin/profile.php can obtain it; the handler is additionally registered via wp_ajax_nopriv_, making it reachable by fully unauthenticated users as well.