Solacewp
Monthly
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all versions through 1.5.3) is achievable by fully unauthenticated network attackers due to the complete absence of authorization checks on the responsible AJAX handler. The handler is registered via wp_ajax_nopriv_, removing WordPress's authentication gate entirely, while the required nonce is leaked to any Subscriber-level user visiting any wp-admin page - eliminating both authentication and authorization barriers simultaneously. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the Wordfence disclosure includes exact file and line references enabling straightforward reproduction; the official CVSS score of 5.3 significantly understates the destructive impact.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Permanent, irreversible deletion of all Starter Template-imported site content in the Solace Extra WordPress plugin (all versions through 1.5.3) is achievable by fully unauthenticated network attackers due to the complete absence of authorization checks on the responsible AJAX handler. The handler is registered via wp_ajax_nopriv_, removing WordPress's authentication gate entirely, while the required nonce is leaked to any Subscriber-level user visiting any wp-admin page - eliminating both authentication and authorization barriers simultaneously. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the Wordfence disclosure includes exact file and line references enabling straightforward reproduction; the official CVSS score of 5.3 significantly understates the destructive impact.