What is the CVSS score of EUVD-2026-59897?

EUVD-2026-59897 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Solace Extra are affected by EUVD-2026-59897?

The Solace Extra WordPress plugin (versions through 1.6.0) contains a critical vulnerability allowing any authenticated user, including Subscriber-level accounts, to permanently destroy site…

How to fix or mitigate EUVD-2026-59897?

Within 24 hours: audit all WordPress instances for Solace Extra plugin presence and user role assignments; temporarily disable the plugin if non-critical to operations, or immediately restrict user access to Administrator accounts only. Within 7 days: review WordPress audit logs and web server records from the past 30 days for unauthorized content changes; restore any compromised content from backups; document all user accounts with plugin access. Within 30 days: monitor the Solace Extra GitHub repository and WordPress plugin directory for patched versions 1.6.1 or later; prepare a deployment plan to upgrade immediately upon patch release; implement role-based access controls to eliminate unnecessary Subscriber account creation.

Solace Extra EUVD-2026-59897

| CVE-2026-18316 CRITICAL

Missing Authorization (CWE-862)

2026-08-16 Wordfence

GHSA-xw86-2976-mc83

WordPress Authentication Bypass Wordpress Plugin Solace Extra Solacewp

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Practical exploitation needs a Subscriber account to read the gating nonce, so PR:L not PR:N; network vector, low complexity, no UI, high integrity/availability impact and no confidentiality loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:17 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.

Articles & Coverage 1

News Critical Unauthorized Data Destruction in WordPress Solace Extra Plugin - CVE-2026-18316 Aug 17, 2026

AnalysisAI

Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:solacewp:solace_extra) that ships a demo/site-import feature. Its import_zip() function is hooked to both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip, exposing it to logged-in and (nominally) logged-out request flows. The root cause is CWE-862 Missing Authorization: the handler performs a nonce check but no current_user_can()/capability check. Critically, the 'ajax-nonce' it validates is generated via wp_localize_script on an unrestricted admin_enqueue_scripts hook, so the nonce is rendered into admin pages for every authenticated role, including Subscriber. A valid nonce therefore does not represent authorization to perform destructive site operations such as update_option('sidebars_widgets', array()) and remove_theme_mods(). This is a common WordPress AJAX anti-pattern where nonce verification is mistaken for a permission gate.

RemediationAI

Upstream fix available (WordPress.org plugin trac changeset 3627961, https://plugins.trac.wordpress.org/changeset?reponame=&old=3627961%40solace-extra&new=3627961%40solace-extra); a released patched version number was not provided in the input and is not independently confirmed, so update to the latest available Solace Extra release above 1.6.0 and verify the changelog references this capability check. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4e427c4e-3e27-49e3-ba64-6241b430d5d8) for fixed-version details. Until patched, apply compensating controls: disable open user registration or set the default role such that untrusted signups cannot be created (trade-off: blocks legitimate self-service registration), and consider deactivating the Solace Extra plugin if the demo-import feature is not in active use (trade-off: loses plugin functionality). A WAF rule blocking POST requests to admin-ajax.php with action=action-import-zip from non-administrator sessions is a stopgap (trade-off: may break legitimate admin-driven imports and requires session/role awareness). Take a full backup of the database and options table before remediation given the destructive nature of the flaw.