WordPress Plugin Vulnerabilities

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

Description

The plugin does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

Proof of Concept

Affects Plugins

Plugin icon
solace-extra
Fixed in 1.6.1

References

CVE
CVE-2026-16948

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
8.1 (high)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Submitter website
https://github.com/jun2e0
Verified
Yes
WPVDB ID
50e47ee9-cffc-4435-bc77-77fc65e9ff16

Timeline

Publicly Published
2026-08-03 (about 26 days ago)
Added
2026-08-03 (about 25 days ago)
Last Updated
2026-08-28 (about 11 hours ago)

Other

Published
Title
Published
2024-03-04
Title
Maintenance Mode < 3.0.2 - Unauthenticated Post/Page Content Disclosure
Published
2021-09-21
Title
WP Mega Menu < 1.4.0 - Unauthenticated Arbitrary Post Access
Published
2024-01-16
Title
User Profile Builder < 3.10.9 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
Published
2024-08-31
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.19 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification
Published
2021-11-01
Title
Stylish Cost Calculator < 7.0.4 - Subscriber+ Unauthorised AJAX Calls to Stored XSS