Solace Extra EUVD-2026-89636

Exploitation requires that the target site run the Solace Extra plugin at a version before 1.7.2 and that the site contain non-published content (draft, pending, private, or scheduled posts/pages) worth reading. The specific prerequisite is use of the plugin's front-end preview routes, which perform no authorization or post-status checks. No authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N/AV:N/AC:L). Limiting factors: impact is confidentiality-only (read access to unpublished content), so value depends on the sensitivity of drafts present; there is no write, modification, or availability impact, and disclosure is bounded to content the plugin's preview routes can render.

Signals are consistent and point to a genuine but low-to-moderate priority issue rather than a high-severity emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) describes a straightforward network-reachable, unauthenticated, no-interaction confidentiality-only flaw, which aligns with the CWE-200 information-disclosure classification and the description of unauthenticated preview-route access. CISA SSVC reinforces a measured stance: Exploitation=none (no observed in-the-wild activity), Automatable=yes (a scanner/script can trivially iterate preview routes across many sites), and Technical Impact=partial (read-only exposure, no integrity or availability effect). No EPSS score, no CISA KEV listing, and no public exploit (POC) are provided, so exploitation status is: no public exploit identified at time of analysis. The 'Automatable: yes' plus PR:N/UI:N combination means opportunistic mass scanning is realistic once a technique is published, but the impact ceiling is limited to disclosure of unpublished/draft content (C:L), not credentials, RCE, or site takeover. No signals conflict; the primary caveat is source depth - the assessment rests on a single WPScan advisory relayed through NVD/EUVD, with no independent vendor advisory text quoted.

An unauthenticated attacker requests the plugin's front-end preview route for a post or page ID that is in draft, pending, private, or scheduled status, and the plugin renders it without checking authorization or post status, returning content WordPress would normally withhold. Because no authentication or user interaction is required and the behavior is scriptable, an attacker could enumerate IDs across a target site (or many sites) to harvest unpublished content. No public proof-of-concept is referenced at time of analysis.