CVE-2026-18316
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Solace Extra plugin for WordPress up to version 1.6.0 is vulnerable to unauthorized modification and data loss due to a missing capability check in the import_zip() function. The function is accessible to any authenticated user, including subscribers, and can wipe navigation menus, widgets, theme mods, and Elementor templates.
Risk Assessment
An attacker with subscriber-level access can destroy important site elements such as menus and widgets, and import unauthorized demo content, potentially leading to data loss and site disruption.
Recommendation
Update the Solace Extra plugin to the latest version if a patch is available. Restrict subscriber account access and regularly back up the site.
Other vulnerabilities in Solace Extra
See all- CVE-2026-80333Unknown
The Solace Extra WordPress plugin before version 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
- CVE-2026-16966Medium
The Solace Extra WordPress plugin before version 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
- CVE-2026-27535High
The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.
- CVE-2026-13250Medium
The Solace Extra plugin for WordPress up to version 1.5.3 is vulnerable to authorization bypass. Unauthenticated attackers can permanently delete all content previously imported via the Starter Template feature, including posts, pages, media, WooCommerce products, taxonomy terms, and templates. The required nonce is exposed on every admin page, and the handler is also registered for unauthenticated users.
Original NVD description (English source)
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS