What is the CVSS score of CVE-2026-27535?

CVE-2026-27535 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Solace Extra are affected by CVE-2026-27535?

Solace Extra WordPress plugin (version 1.6.0 and earlier) contains a broken access control vulnerability allowing subscriber accounts to perform unauthorized administrative operations.

How to fix or mitigate CVE-2026-27535?

Within 24 hours, audit all WordPress instances running Solace Extra plugin version 1.6.0 or earlier for unauthorized activity by subscriber accounts and document affected deployments. Within 7 days, contact the vendor to determine upgrade availability or establish a timeline; if no patched version exists, implement interim access controls to restrict subscriber-level plugin permissions and audit user role capabilities. Within 30 days, execute a remediation plan by either upgrading to a patched version when available, switching to an alternative plugin, or implementing persistent compensating controls including subscriber capability restrictions and continuous activity monitoring.

Solace Extra CVE-2026-27535

EUVD-2026-57933 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-vh2c-4fjr-m57c

WordPress Authentication Bypass Wordpress Plugin Solace Extra Solacewp

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Subscriber account required (PR:L); no special conditions on a network-accessible WordPress endpoint (AV:N/AC:L); high availability and low integrity impact per missing authorization pattern; no confidentiality or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:04 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

AnalysisAI

Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) indicates that the plugin fails to verify whether the requesting user holds sufficient permissions before executing sensitive operations - a common pattern in WordPress plugins where REST API endpoints or AJAX handlers omit capability checks. The affected component is identified by CPE cpe:2.3:a:solacewp:solace_extra:*:*:*:*:*:*:*:*, covering all Solace Extra releases through 1.6.0. WordPress subscribers are the lowest built-in user role, typically granted automatically upon site registration, making the attack surface broad on any site that allows open user registration.

RemediationAI

Update the Solace Extra plugin to a version beyond 1.6.0 once a patched release is confirmed available via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/solace-extra/vulnerability/wordpress-solace-extra-plugin-1-6-0-broken-access-control-vulnerability. No exact fix version is independently confirmed from the provided data - verify with the vendor before assuming any specific release resolves the issue. As an immediate compensating control, disable open user registration on WordPress sites running this plugin (Settings → General → uncheck 'Anyone can register') to eliminate the low-privilege account vector. If the plugin's affected functionality is non-essential, deactivating Solace Extra until a vetted patch is available removes exposure entirely, with the trade-off of losing associated plugin features.