CVE-2026-18316: Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip() function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wplocalizescript (unrestricted adminenqueuescripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via updateoption('sidebarswidgets', array())), all theme mods (via removethememods()), and Elementor templates, as well as trigger arbitrary demo-content imports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Solace Extra plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.6.0 - Configuration
Modify the Solace Extra plugin so the import_zip() handler performs an explicit WordPress capability/permission check before processing the AJAX request, and do not allow Subscriber-level (or unauthenticated) users via wp_ajax_nopriv_action-import-zip.
WordPress Solace Extra plugin import_zip capability check on import_zip() (authorization) = Enforce a capability check so only authorized users can invoke import_zip() behind wp_ajax_action-import-zip/wp_ajax_nopriv_action-import-zip - Compensating control
If possible, restrict the ability to enqueue/emit the 'ajax-nonce' and limit access to the affected Solace Extra AJAX endpoints so that only users with sufficient privileges can reach wp_ajax_action-import-zip / wp_ajax_nopriv_action-import-zip (e.g., via plugin/endpoint-level access controls).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18316?
CVE-2026-18316 has a critical severity score of 9.1.
What are the consequences of CVE-2026-18316?
CVE-2026-18316 allows unauthorized modification and potential loss of data due to missing capability checks.
Who is affected by CVE-2026-18316?
Users of the Solace Extra plugin for WordPress versions 1.6.0 and below are affected by CVE-2026-18316.
How do I fix CVE-2026-18316?
To fix CVE-2026-18316, update the Solace Extra plugin to the latest version that addresses this vulnerability.
What versions does CVE-2026-18316 impact?
CVE-2026-18316 impacts all versions of the Solace Extra plugin up to and including 1.6.0.