CVE-2026-16965: Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Solace Extra WordPress pluginto a version that resolves this vulnerability.Fixed in 1.6.1 - Compensating control
As a mitigation until upgraded, restrict access to WordPress to prevent CSRF or limit logged-in (subscriber) users’ ability to trigger the plugin’s vulnerable AJAX actions (e.g., reduce the number of users who can reach those endpoints, and ensure untrusted users cannot perform state-changing requests).