8.1
High
CVE-2026-16948 The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and…
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Solace Extra 1.6 | earliest → < 1.6.1 | 1.6.1 |
Other CVEs of Solace Extra
The 4 CVEs of Solace Extra →
CVE-2026-80333
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end…
5.3
Medium
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its…
5.3
Medium
CVE-2026-16965
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions,…
4.3
Medium