CVE-2026-16965: Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Solace Extra WordPress pluginto a version that resolves this vulnerability.Fixed in 1.6.1 - Compensating control
As a mitigation until upgraded, restrict access to WordPress to prevent CSRF or limit logged-in (subscriber) users’ ability to trigger the plugin’s vulnerable AJAX actions (e.g., reduce the number of users who can reach those endpoints, and ensure untrusted users cannot perform state-changing requests).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16965?
CVE-2026-16965 is rated with a risk score of 52.
How do I fix CVE-2026-16965?
To fix CVE-2026-16965, update the Solace Extra WordPress plugin to version 1.6.1 or later.
What are the consequences of CVE-2026-16965?
CVE-2026-16965 allows authenticated users to update post meta and deactivate active templates on the site.
Who is affected by CVE-2026-16965?
Any user with authentication, including subscribers and any logged-in users, can be affected by CVE-2026-16965.
What type of vulnerability is CVE-2026-16965?
CVE-2026-16965 is a Cross-Site Request Forgery (CSRF) vulnerability.