CVE-2026-18316
CriticalCVSS 9.1Summary
The Solace Extra plugin for WordPress up to version 1.6.0 is vulnerable to unauthorized modification and data loss due to a missing capability check in the import_zip() function. The function is accessible to any authenticated user, including subscribers, and can wipe navigation menus, widgets, theme mods, and Elementor templates.
Risk Assessment
An attacker with subscriber-level access can destroy important site elements such as menus and widgets, and import unauthorized demo content, potentially leading to data loss and site disruption.
Recommendation
Update the Solace Extra plugin to the latest version if a patch is available. Restrict subscriber account access and regularly back up the site.
Original NVD description (English source)
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.