4.3
Moyenne
CVE-2026-16965 The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions,…
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Solace Extra 1.6 | premières → < 1.6.1 | 1.6.1 |
Autres CVE de Solace Extra
Les 4 CVE de Solace Extra →
CVE-2026-80333
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end…
5.3
Moyenne
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its…
5.3
Moyenne
CVE-2026-16948
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and…
8.1
Élevée