EUVD-2026-69867
GHSA-34wr-p98q-h643
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-reachable AJAX endpoint; confidentiality impact is low (draft/private post content only), with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
AnalysisAI
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond Solace Extra being installed and active at any version before 1.7.0 on a WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 medium rating (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the vulnerability mechanics: zero authentication is needed, no interaction is required from a victim, and exploitation is network-reachable - but the confidentiality impact is bounded to unpublished post content rather than credentials, session tokens, or code. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Solace Extra to version 1.7.0 or later via the standard WordPress plugin update mechanism (wp-admin > Plugins > Available Updates) or by downloading the updated package from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Solace Extra
View allPrivilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Sub
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenti
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authoriza
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today