Solace Extra
Monthly
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all versions through 1.5.3) is achievable by fully unauthenticated network attackers due to the complete absence of authorization checks on the responsible AJAX handler. The handler is registered via wp_ajax_nopriv_, removing WordPress's authentication gate entirely, while the required nonce is leaked to any Subscriber-level user visiting any wp-admin page - eliminating both authentication and authorization barriers simultaneously. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the Wordfence disclosure includes exact file and line references enabling straightforward reproduction; the official CVSS score of 5.3 significantly understates the destructive impact.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all versions through 1.5.3) is achievable by fully unauthenticated network attackers due to the complete absence of authorization checks on the responsible AJAX handler. The handler is registered via wp_ajax_nopriv_, removing WordPress's authentication gate entirely, while the required nonce is leaked to any Subscriber-level user visiting any wp-admin page - eliminating both authentication and authorization barriers simultaneously. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the Wordfence disclosure includes exact file and line references enabling straightforward reproduction; the official CVSS score of 5.3 significantly understates the destructive impact.