EUVD-2026-54743
GHSA-pxjh-xm4v-xwq9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-accessible AJAX endpoints require only a Subscriber session (PR:L, AC:L); content deletion and settings overwrite yield high I and A; no data exposure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
AnalysisAI
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
Technical ContextAI
Solace Extra is a WordPress plugin (CPE: cpe:2.3:a:unknown:solace_extra:*:*:*:*:*:*:*:*) that extends page-builder functionality with site-wide presentation and content import capabilities. The root cause is CWE-284 (Improper Access Control): the plugin registers multiple AJAX action handlers without invoking WordPress capability checks such as current_user_can(), which are the standard mechanism for enforcing role-based permissions in the WordPress ecosystem. Compounding this flaw, the nonces protecting these AJAX calls are rendered on admin pages accessible to Subscriber-level users. WordPress nonces are designed as CSRF tokens, not authorization gates; when they are exposed to lower-privileged users without an accompanying capability check, they provide no meaningful access control. This two-part failure - absent capability enforcement plus nonce leakage - means any registered user can exercise administrator-level plugin functionality remotely over the network.
RemediationAI
The primary fix is to upgrade Solace Extra to version 1.6.1 or later, which introduces the missing capability checks in the affected AJAX handlers; this is a vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/. The update should be applied immediately through the WordPress plugin dashboard. As a compensating control for sites that cannot update immediately, administrators should disable open user registration under Settings > General by unchecking 'Anyone can register', which eliminates the ability for external parties to obtain a Subscriber account; note this will block legitimate self-registration workflows if the site depends on them. Administrators should also audit the WordPress user list for unexpected Subscriber-level accounts and review recent changes to site presentation settings and site-builder content as part of incident triage.
More in Solace Extra
View allUnauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenti
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authoriza
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today