CVE-2026-16966
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Solace Extra WordPress plugin before version 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
Risk Assessment
The risk is the exposure of non-public content to unauthorized parties, potentially compromising site confidentiality and integrity.
Recommendation
Update the Solace Extra plugin to version 1.7.0 or later, which includes the fix.
Other vulnerabilities in Solace Extra
See all- CVE-2026-18316Critical
The Solace Extra plugin for WordPress up to version 1.6.0 is vulnerable to unauthorized modification and data loss due to a missing capability check in the import_zip() function. The function is accessible to any authenticated user, including subscribers, and can wipe navigation menus, widgets, theme mods, and Elementor templates.
- CVE-2026-27535High
The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.
- CVE-2026-13250Medium
The Solace Extra plugin for WordPress up to version 1.5.3 is vulnerable to authorization bypass. Unauthenticated attackers can permanently delete all content previously imported via the Starter Template feature, including posts, pages, media, WooCommerce products, taxonomy terms, and templates. The required nonce is exposed on every admin page, and the handler is also registered for unauthenticated users.
Original NVD description (English source)
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS