CVE-2026-16966: Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.
Affected Software
Event History
Frequently Asked Questions
Which content can be exposed to unauthenticated visitors?
Unauthenticated visitors can read Site Builder parts whose WordPress status is draft, pending, private, or trashed. These are non-published items that WordPress would normally not serve publicly.
Does exploitation require a WordPress account or special permissions?
No. The affected AJAX action lacks authorization and post-status checks, so unauthenticated visitors can access the affected non-published Site Builder content.
Which plugin versions are affected?
Versions of Solace Extra before 1.7.0 are affected. Upgrading to 1.7.0 or later addresses the missing checks described in the vulnerability.