8.1
Élevée
CVE-2026-16948 The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and…
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Solace Extra 1.6 | premières → < 1.6.1 | 1.6.1 |
Autres CVE de Solace Extra
Les 4 CVE de Solace Extra →
CVE-2026-80333
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end…
5.3
Moyenne
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its…
5.3
Moyenne
CVE-2026-16965
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions,…
4.3
Moyenne