4.3
Medium
CVE-2026-16965 The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions,…
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Solace Extra 1.6 | earliest → < 1.6.1 | 1.6.1 |
Other CVEs of Solace Extra
The 4 CVEs of Solace Extra →
CVE-2026-80333
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end…
5.3
Medium
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its…
5.3
Medium
CVE-2026-16948
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and…
8.1
High