Broken Access Control in Solace Extra Plugin for WordPress

The Solace Extra plugin for WordPress, in versions 1.6.0 and earlier, contains a critical broken access control vulnerability due to insufficient capability checks in the import_zip() function. The plugin registers handlers for the AJAX actions 'wp_ajax_action-import-zip' and 'wp_ajax_nopriv_action-import-zip', but only performs validation against an 'ajax-nonce'. This nonce is accessible to all authenticated users, including Subscribers, via the 'wp_localize_script' function on every admin page. This design flaw allows any authenticated user to execute privileged administrative functions, such as wiping navigation menus, clearing sidebar widgets, removing theme modifications, and deleting Elementor templates. Additionally, the vulnerability allows unauthorized actors to trigger arbitrary demo-content imports, leading to potential data loss or site defacement. Defenders should prioritize updating to a patched version or disabling the plugin until a remediation is applied.

Impact

The vulnerability results in unauthorized configuration changes and total data loss of specific WordPress site components. Attackers with low-level privileges (Subscriber) can maliciously modify or delete navigation menus, sidebar widgets, theme modifications, and Elementor templates, severely impacting site functionality and integrity.

Recommendation

• Identify all WordPress instances running Solace Extra version 1.6.0 or lower.
• Disable or uninstall the Solace Extra plugin until the vendor releases and deploys a patch that implements proper capability checks (e.g., 'manage_options') in the import_zip() function.
• Audit existing WordPress installations for unauthorized modifications to sidebar widgets, theme mods, or navigation menus occurring after the plugin installation.
• Monitor web server access logs for anomalous POST requests to the 'admin-ajax.php' endpoint matching the identified plugin action names.