WordPress Plugin Vulnerabilities

Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

Description

The plugin does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.

Proof of Concept

Affects Plugins

Plugin icon
solace-extra
Fixed in 1.7.0

References

CVE
CVE-2026-16966

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Submitter website
https://github.com/jun2e0
Verified
Yes
WPVDB ID
44090198-8eb9-4799-aad0-841e80e70aab

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2024-01-10
Title
Profile Builder Pro < 3.10.1 - Authenticated (Subscriber+) Time-Based One-Time Password Sensitive Information Exposure
Published
2025-03-10
Title
Qubely < 1.8.14 - Contributor+ Sensitive Information Exposure
Published
2024-05-03
Title
Robo Gallery < 3.2.19 - Unauthenticated Information Exposure
Published
2025-06-19
Title
ProfileGrid < 5.9.5.3 - Authenticated (Subscriber+) Full Path Disclosure
Published
2025-09-22
Title
Hubbub Lite < 1.36.0- Subscriber+ Sensitive Information Exposure