{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/solace-extra--1.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-18316"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Solace Extra (\u003c= 1.6.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Solace Extra plugin for WordPress, in versions 1.6.0 and earlier, contains a critical broken access control vulnerability due to insufficient capability checks in the import_zip() function. The plugin registers handlers for the AJAX actions 'wp_ajax_action-import-zip' and 'wp_ajax_nopriv_action-import-zip', but only performs validation against an 'ajax-nonce'. This nonce is accessible to all authenticated users, including Subscribers, via the 'wp_localize_script' function on every admin page. This design flaw allows any authenticated user to execute privileged administrative functions, such as wiping navigation menus, clearing sidebar widgets, removing theme modifications, and deleting Elementor templates. Additionally, the vulnerability allows unauthorized actors to trigger arbitrary demo-content imports, leading to potential data loss or site defacement. Defenders should prioritize updating to a patched version or disabling the plugin until a remediation is applied.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in unauthorized configuration changes and total data loss of specific WordPress site components. Attackers with low-level privileges (Subscriber) can maliciously modify or delete navigation menus, sidebar widgets, theme modifications, and Elementor templates, severely impacting site functionality and integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances running Solace Extra version 1.6.0 or lower.\u003c/li\u003e\n\u003cli\u003eDisable or uninstall the Solace Extra plugin until the vendor releases and deploys a patch that implements proper capability checks (e.g., 'manage_options') in the import_zip() function.\u003c/li\u003e\n\u003cli\u003eAudit existing WordPress installations for unauthorized modifications to sidebar widgets, theme mods, or navigation menus occurring after the plugin installation.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to the 'admin-ajax.php' endpoint matching the identified plugin action names.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-16T06:24:29Z","date_published":"2026-08-16T06:24:29Z","id":"https://feed.craftedsignal.io/briefs/2026-08-solace-extra-vulnerability/","summary":"The Solace Extra plugin for WordPress (\u003c= 1.6.0) contains a broken access control vulnerability in the import_zip() function that allows authenticated users to delete critical theme settings and content.","title":"Broken Access Control in Solace Extra Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-08-solace-extra-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Solace Extra (\u003c= 1.6.0)","version":"https://jsonfeed.org/version/1.1"}