CVE-2026-80333
UnknownSummary
The Solace Extra WordPress plugin before version 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
Risk Assessment
The risk is unauthorized access to content that should be private or non-public, which could expose sensitive information or breach confidentiality.
Recommendation
It is recommended to update the Solace Extra plugin to version 1.7.2 or later, which includes authorization and post-status check fixes.
Other vulnerabilities in Solace Extra
See all- CVE-2026-18316Critical
The Solace Extra plugin for WordPress up to version 1.6.0 is vulnerable to unauthorized modification and data loss due to a missing capability check in the import_zip() function. The function is accessible to any authenticated user, including subscribers, and can wipe navigation menus, widgets, theme mods, and Elementor templates.
- CVE-2026-16966Medium
The Solace Extra WordPress plugin before version 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
- CVE-2026-27535High
The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.
- CVE-2026-13250Medium
The Solace Extra plugin for WordPress up to version 1.5.3 is vulnerable to authorization bypass. Unauthenticated attackers can permanently delete all content previously imported via the Starter Template feature, including posts, pages, media, WooCommerce products, taxonomy terms, and templates. The required nonce is exposed on every admin page, and the handler is also registered for unauthenticated users.
Original NVD description (English source)
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS